diff --git a/test/ui-e2e/README.md b/test/ui-e2e/README.md
index 99ca40bde86..b3c70867433 100644
--- a/test/ui-e2e/README.md
+++ b/test/ui-e2e/README.md
@@ -39,16 +39,19 @@ export CLUSTER_PASSWORD="<your_cluster_password>"
 export OC_API_URL="<your_cluster_server_url>"
 export IDP="kube:admin" # (Optional) Defaults to kube:admin
 
-# Optional — private-repo.spec.ts (credentials in Bitwarden)
+# Optional — private-repo.spec.ts (credentials in Bitwarden or cluster secret)
 export PRIVATE_REPO_URL="<private_git_https_url>"
-export PRIVATE_REPO_USERNAME="<username>"
-export PRIVATE_REPO_TOKEN="<token_or_password>"
+export PRIVATE_REPO_TOKEN="<access_token_or_pat>"
 EOF
 ```
 
 > **Security Warning:** The `.env` file is explicitly ignored by Git. Please don't commit credentials to the repository.
 
-The private repository test is **skipped** unless `PRIVATE_REPO_URL` and `PRIVATE_REPO_TOKEN` (or `PRIVATE_REPO_PASSWORD`) are set. Shared values are available from **Bitwarden**.
+**Private Repository Test:** The test is **skipped** unless both `PRIVATE_REPO_URL` and `PRIVATE_REPO_TOKEN` are set. Credentials are stored in:
+- **Bitwarden** (for local testing)
+- **Cluster Secret** `ui-e2e-private-repo` (for CI/pipeline execution)
+
+The username defaults to `x-access-token` for token-based authentication and does not need to be configured.
 
 ---
 
diff --git a/test/ui-e2e/run-ui-tests.sh b/test/ui-e2e/run-ui-tests.sh
index 1b59649b0a2..099a309cea7 100755
--- a/test/ui-e2e/run-ui-tests.sh
+++ b/test/ui-e2e/run-ui-tests.sh
@@ -15,11 +15,24 @@ done
 #making sure we are in the correct dir
 cd "$(dirname "$0")" || exit 1
 
-if [ -f .env ]; then
-  echo "Loading variables from .env file..."
-  set -a  #export all variables
-  source .env
-  set +a  #stop auto export
+# Load environment variables based on mode
+if [ "$ENV" = "ci" ] || [ "$ENV" = "pipeline" ]; then
+    #ci/pipeline use only exported variables from the environment
+    echo "Running in CI/pipeline mode - using exported environment variables..."
+    #warn if private repo credentials are missing
+    if [ -z "$PRIVATE_REPO_URL" ]; then
+        echo "Warning: PRIVATE_REPO_URL not set - private repo tests may be skipped"
+    fi
+else
+    #local try .env first then fall back to exported variables
+    if [ -f .env ]; then
+        echo "Loading variables from .env file..."
+        set -a  #export all variables
+        source .env
+        set +a  #stop auto export
+    else
+        echo "No .env file found, using shell-exported variables..."
+    fi
 fi
 
 #username (might be something different for rosa - can be overwritten with export CLUSTER_USER)
diff --git a/test/ui-e2e/tests/private-repo.spec.ts b/test/ui-e2e/tests/private-repo.spec.ts
index d7143104deb..64e1f37bda5 100644
--- a/test/ui-e2e/tests/private-repo.spec.ts
+++ b/test/ui-e2e/tests/private-repo.spec.ts
@@ -4,11 +4,11 @@ import { clusterCanResolveHostname, hostnameFromRepoUrl } from '../src/utils/clu
 
 test.describe('Private Git Repository Connection', () => {
   const repoUrl = process.env.PRIVATE_REPO_URL || '';
-  const username = process.env.PRIVATE_REPO_USERNAME || 'x-access-token';
-  const password = process.env.PRIVATE_REPO_PASSWORD || process.env.PRIVATE_REPO_TOKEN || '';
+  const username = 'x-access-token';
+  const token = process.env.PRIVATE_REPO_TOKEN || '';
 
   test.beforeEach(() => {
-    test.skip(!repoUrl || !password, 'requires PRIVATE_REPO_URL and PRIVATE_REPO_PASSWORD (or PRIVATE_REPO_TOKEN)');
+    test.skip(!repoUrl || !token, 'requires PRIVATE_REPO_URL and PRIVATE_REPO_TOKEN');
 
     const host = hostnameFromRepoUrl(repoUrl);
     if (!clusterCanResolveHostname(host)) {
@@ -21,7 +21,7 @@ test.describe('Private Git Repository Connection', () => {
   });
 
   test.afterEach(async ({ page }, testInfo) => {
-    if (!repoUrl || !password || testInfo.status === 'skipped') return;
+    if (!repoUrl || !token || testInfo.status === 'skipped') return;
     console.log('[teardown] removing configured private repository');
     const reposPage = new SettingsRepositoriesPage(page);
     await reposPage.ensureRepoRemoved(repoUrl);
@@ -32,7 +32,7 @@ test.describe('Private Git Repository Connection', () => {
 
     const reposPage = new SettingsRepositoriesPage(page);
     await reposPage.navigate();
-    await reposPage.connectHttpsRepo(repoUrl, username, password);
+    await reposPage.connectHttpsRepo(repoUrl, username, token);
     await reposPage.assertConnectionSuccessful(repoUrl);
   });
 });