diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/All.php b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
index 47080cd86b..cc45568d2e 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/All.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
@@ -753,7 +753,14 @@ class All extends Component
         }
         // Otherwise keep order from docker-compose file
 
-        return $hardcodedVars;
+        // Compose content is visible only to users who can edit the resource.
+        $canViewValues = auth()->user()?->can('update', $this->resource) ?? false;
+
+        return $hardcodedVars->map(fn (array $variable): array => [
+            ...$variable,
+            'value' => $canViewValues ? $variable['value'] : null,
+            'is_value_hidden' => ! $canViewValues,
+        ]);
     }
 
     /** @return list<string> */
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/ShowHardcoded.php b/app/Livewire/Project/Shared/EnvironmentVariable/ShowHardcoded.php
index 8e85c40b17..a7d7a73602 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/ShowHardcoded.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/ShowHardcoded.php
@@ -17,6 +17,9 @@ class ShowHardcoded extends Component
     #[Locked]
     public ?string $value = null;
 
+    #[Locked]
+    public bool $isValueHidden = true;
+
     public ?string $comment = null;
 
     public ?string $serviceName = null;
@@ -34,6 +37,7 @@ class ShowHardcoded extends Component
     {
         $this->key = $this->env['key'];
         $this->value = $this->env['value'] ?? null;
+        $this->isValueHidden = $this->env['is_value_hidden'] ?? true;
         $this->comment = $this->env['comment'] ?? null;
         $this->serviceName = $this->env['service_name'] ?? null;
     }
diff --git a/resources/views/livewire/project/shared/environment-variable/show-hardcoded.blade.php b/resources/views/livewire/project/shared/environment-variable/show-hardcoded.blade.php
index 5492d33f90..6750e9c3ea 100644
--- a/resources/views/livewire/project/shared/environment-variable/show-hardcoded.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/show-hardcoded.blade.php
@@ -29,7 +29,7 @@
         <span class="data-table-cell-dash">-</span>
         <span class="data-table-cell-dash">-</span>
         <div class="flex items-center gap-0.5 justify-self-end">
-            @unless (auth()->user()?->isMember() ?? true)
+            @unless ($isValueHidden)
                 <x-copy-button resolve="$wire.copyValue()" label="Copy value" />
             @endunless
             <x-modal-input title="Environment variable details" :closeOutside="false">
@@ -41,7 +41,15 @@
                 </x-slot:content>
                 <div class="flex w-full flex-col gap-4">
                     <x-forms.input label="Name" :value="$key" readonly />
-                    <x-forms.input label="Value" :value="$value ?? ''" readonly />
+                    @if ($isValueHidden)
+                        <div class="w-full">
+                            <label class="mb-1 flex items-center gap-1 text-sm font-medium">Value</label>
+                            <input disabled type="text" value="Hidden (only admins can view)"
+                                class="input w-full italic !text-neutral-500 dark:!text-neutral-500" />
+                        </div>
+                    @else
+                        <x-forms.input label="Value" :value="$value ?? ''" readonly />
+                    @endif
                     @if (filled($comment))
                         <x-forms.input label="Comment" :value="$comment" readonly />
                     @endif
diff --git a/tests/Feature/Authorization/ComposeContentVisibilityTest.php b/tests/Feature/Authorization/ComposeContentVisibilityTest.php
index 830a945ed7..7b5a7491db 100644
--- a/tests/Feature/Authorization/ComposeContentVisibilityTest.php
+++ b/tests/Feature/Authorization/ComposeContentVisibilityTest.php
@@ -3,6 +3,7 @@
 use App\Livewire\Project\Application\General as ApplicationGeneral;
 use App\Livewire\Project\Service\EditCompose;
 use App\Livewire\Project\Service\StackForm;
+use App\Livewire\Project\Shared\EnvironmentVariable\All as EnvironmentVariables;
 use App\Models\Application;
 use App\Models\InstanceSettings;
 use App\Models\Project;
@@ -86,3 +87,33 @@ it('keeps compose content available to an owner', function () {
         expect($component->get('dockerCompose'))->toContain('TOKEN:');
     }
 });
+
+it('keeps hardcoded compose values out of the member environment variable list', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    foreach ([$this->application, $this->service] as $resource) {
+        $component = Livewire::test(EnvironmentVariables::class, ['resource' => $resource])
+            ->call('loadEnvironmentVariables');
+
+        expect($component->instance()->hardcodedEnvironmentVariables->pluck('key')->all())->toBe(['TOKEN'])
+            ->and(json_encode($component->snapshot).$component->html())
+            ->not->toContain('stored-raw-compose-value')
+            ->not->toContain('stored-generated-compose-value')
+            ->not->toContain('Copy value')
+            ->toContain('Hidden (only admins can view)');
+    }
+});
+
+it('shows hardcoded compose values to an owner', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    foreach ([$this->application, $this->service] as $resource) {
+        Livewire::test(EnvironmentVariables::class, ['resource' => $resource])
+            ->call('loadEnvironmentVariables')
+            ->assertSee('stored-raw-compose-value')
+            ->assertSeeHtml('Copy value')
+            ->assertDontSee('Hidden (only admins can view)');
+    }
+});