diff --git a/internal/store/store_test.go b/internal/store/store_test.go
index 236ba10..6b15949 100644
--- a/internal/store/store_test.go
+++ b/internal/store/store_test.go
@@ -116,6 +116,13 @@ func TestMigration0009Schema(t *testing.T) {
 		t.Fatal("expected unique constraint violation on (host_id, kind), got nil")
 	}
 
+	// CHECK (kind IN ('repo','admin')) must reject an invalid kind.
+	if _, err := s.DB().ExecContext(ctx,
+		`INSERT INTO host_credentials (host_id, kind, enc_repo_creds, updated_at) VALUES (?,?,?,?)`,
+		"h-0009", "other", "enc-other", now); err == nil {
+		t.Fatal("expected CHECK constraint violation on kind='other', got nil")
+	}
+
 	// host_repo_stats table must exist with expected columns.
 	if _, err := s.DB().ExecContext(ctx,
 		`INSERT INTO host_repo_stats (host_id, lock_present, updated_at) VALUES (?,?,?)`,