diff --git a/tests/creator_web/verify-remote.ps1 b/tests/creator_web/verify-remote.ps1
index 92da63d..662f77d 100644
--- a/tests/creator_web/verify-remote.ps1
+++ b/tests/creator_web/verify-remote.ps1
@@ -37,6 +37,19 @@ function Post-CoreJson([string]$url, [object]$body) {
     }
 }
 
+function Get-ContainerSecret([object[]]$environment, [string]$name) {
+    $fileEntry = $environment | Where-Object { $_ -like "${name}_FILE=*" } | Select-Object -First 1
+    if ($fileEntry) {
+        $path = $fileEntry.Substring("${name}_FILE=".Length)
+        $value = docker --context $DockerContext exec $coreContainer sh -c "cat -- '$path'"
+        if ($LASTEXITCODE -ne 0 -or -not $value) { throw "$name file-backed secret is not readable" }
+        return ($value -join "`n").TrimEnd("`r", "`n")
+    }
+    $entry = $environment | Where-Object { $_ -like "${name}=*" } | Select-Object -First 1
+    if (-not $entry) { throw "$name is not configured" }
+    return $entry.Substring("${name}=".Length)
+}
+
 $health = Invoke-RestMethod -Uri "$BaseURL/healthz" -Method Get
 if ($health.status -ne "ok" -or $health.runtime -ne "creator-web") { throw "Creator web health response is invalid" }
 
@@ -52,19 +65,14 @@ $invalid = Invoke-WebRequest -Uri "$BaseURL/api/session/current" -Headers @{Auth
 if ($invalid.StatusCode -ne 401) { throw "Invalid Creator session was not denied" }
 
 $environment = docker --context $DockerContext inspect --format '{{range .Config.Env}}{{println .}}{{end}}' $coreContainer
-$usernameEntry = $environment | Where-Object { $_ -like "CREATOR_USERNAME=*" } | Select-Object -First 1
-$passwordEntry = $environment | Where-Object { $_ -like "CREATOR_PASSWORD=*" } | Select-Object -First 1
-if (-not $usernameEntry -or -not $passwordEntry) { throw "Creator username/password is not configured" }
-$creatorUsername = $usernameEntry.Substring("CREATOR_USERNAME=".Length)
-$creatorPassword = $passwordEntry.Substring("CREATOR_PASSWORD=".Length)
+$creatorUsername = Get-ContainerSecret $environment "CREATOR_USERNAME"
+$creatorPassword = Get-ContainerSecret $environment "CREATOR_PASSWORD"
 $invalidCredentials = Invoke-WebRequest -Uri "$BaseURL/api/session" -Method Post -ContentType "application/json" -Body (@{username=$creatorUsername;password="invalid"} | ConvertTo-Json -Compress) -SkipHttpErrorCheck
 if ($invalidCredentials.StatusCode -ne 401) { throw "Invalid Creator credentials were not denied" }
 $issued = Invoke-RestMethod -Uri "$BaseURL/api/session" -Method Post -ContentType "application/json" -Body (@{username=$creatorUsername;password=$creatorPassword} | ConvertTo-Json -Compress)
 if (-not $issued.Token) { throw "Creator username/password session was not issued through the gateway" }
 
-$bootstrapEntry = $environment | Where-Object { $_ -like "CREATOR_BOOTSTRAP_TOKEN=*" } | Select-Object -First 1
-if (-not $bootstrapEntry) { throw "Creator bootstrap token is not configured" }
-$bootstrapToken = $bootstrapEntry.Substring("CREATOR_BOOTSTRAP_TOKEN=".Length)
+$bootstrapToken = Get-ContainerSecret $environment "CREATOR_BOOTSTRAP_TOKEN"
 $recoveryIssued = Invoke-RestMethod -Uri "$BaseURL/api/session" -Method Post -Headers @{Authorization="Bearer $bootstrapToken"}
 if (-not $recoveryIssued.Token) { throw "Creator recovery session was not issued through the gateway" }
 $current = Invoke-RestMethod -Uri "$BaseURL/api/session/current" -Method Get -Headers @{Authorization="Bearer $($issued.Token)"}