diff --git a/src/fastapi_cloud_cli/commands/env.py b/src/fastapi_cloud_cli/commands/env.py
index e592fdb..f4de2cc 100644
--- a/src/fastapi_cloud_cli/commands/env.py
+++ b/src/fastapi_cloud_cli/commands/env.py
@@ -1,6 +1,6 @@
 import logging
 from pathlib import Path
-from typing import Annotated, Any, Union
+from typing import Annotated, Any, Optional, Union
 
 import typer
 from pydantic import BaseModel
@@ -16,7 +16,7 @@
 
 class EnvironmentVariable(BaseModel):
     name: str
-    value: str
+    value: Optional[str] = None
 
 
 class EnvironmentVariableResponse(BaseModel):
diff --git a/tests/test_env_list.py b/tests/test_env_list.py
index aa54b78..860cc92 100644
--- a/tests/test_env_list.py
+++ b/tests/test_env_list.py
@@ -85,3 +85,32 @@ def test_shows_environment_variables_names(
     assert result.exit_code == 0
     assert "SECRET_KEY" in result.output
     assert "API_KEY" in result.output
+
+
+@pytest.mark.respx(base_url=settings.base_api_url)
+def test_shows_secret_environment_variables_without_value(
+    logged_in_cli: None, respx_mock: respx.MockRouter, configured_app: ConfiguredApp
+) -> None:
+    """Test that secret env vars without a value field are handled correctly."""
+    respx_mock.get(f"/apps/{configured_app.app_id}/environment-variables/").mock(
+        return_value=Response(
+            200,
+            json={
+                "data": [
+                    {
+                        "name": "SECRET_KEY",
+                        "is_secret": True,
+                        "created_at": "2026-01-13T19:01:07.408378Z",
+                        "updated_at": "2026-01-13T19:01:07.408389Z",
+                        "connected_resource": None,
+                    },
+                ]
+            },
+        )
+    )
+
+    with changing_dir(configured_app.path):
+        result = runner.invoke(app, ["env", "list"])
+
+    assert result.exit_code == 0
+    assert "SECRET_KEY" in result.output