diff --git a/src/manifest.ts b/src/manifest.ts
index 8071001..67ed3b2 100644
--- a/src/manifest.ts
+++ b/src/manifest.ts
@@ -37,6 +37,7 @@ const manifest: PaperclipPluginManifestV1 = {
       forgejoTokenRef: {
         type: "string",
         title: "Forgejo Token Secret Ref",
+        format: "secret-ref",
         description: "Secret reference for outbound Forgejo API authentication."
       },
       forgejoOwner: {
diff --git a/tests/manifest.spec.ts b/tests/manifest.spec.ts
new file mode 100644
index 0000000..3b2dda4
--- /dev/null
+++ b/tests/manifest.spec.ts
@@ -0,0 +1,13 @@
+import { describe, expect, it } from "vitest";
+import manifest from "../src/manifest.js";
+
+describe("manifest", () => {
+  it("declares the Forgejo token config as a secret ref", () => {
+    const tokenField = manifest.instanceConfigSchema?.properties?.forgejoTokenRef;
+
+    expect(tokenField).toMatchObject({
+      type: "string",
+      format: "secret-ref"
+    });
+  });
+});