diff --git a/internal/secrets/vault_integration_test.go b/internal/secrets/vault_integration_test.go
new file mode 100644
index 0000000..1a2fdc8
--- /dev/null
+++ b/internal/secrets/vault_integration_test.go
@@ -0,0 +1,34 @@
+package secrets
+
+import (
+	"os"
+	"testing"
+)
+
+// Against a real Vault or OpenBao: LLMGW_TEST_VAULT_ADDR and VAULT_TOKEN, a
+// KV v2 secret secret/llmgw-test with field dsn, and a transit key
+// llmgw-test.
+func TestARealVault(t *testing.T) {
+	addr := os.Getenv("LLMGW_TEST_VAULT_ADDR")
+	if addr == "" {
+		t.Skip("set LLMGW_TEST_VAULT_ADDR (and VAULT_TOKEN) to run against a real Vault")
+	}
+	ctx := t.Context()
+	if err := Configure(Vault{Addr: addr}); err != nil {
+		t.Fatal(err)
+	}
+	if v, err := ReadString(ctx, "vault:secret/llmgw-test#dsn"); err != nil || v != "postgres://real" {
+		t.Errorf("kv: %q %v", v, err)
+	}
+	s, err := NewSealer(ctx, "vault-transit:llmgw-test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	sealed, err := s.Seal(ctx, []byte("engine-key"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, err := s.Open(ctx, sealed); err != nil || string(got) != "engine-key" {
+		t.Errorf("transit: %q %v", got, err)
+	}
+}