diff --git a/nuxt.config.test.ts b/nuxt.config.test.ts
index 0c8c32c..1fb63dc 100644
--- a/nuxt.config.test.ts
+++ b/nuxt.config.test.ts
@@ -7,6 +7,17 @@ afterEach(() => {
   vi.resetModules()
 })
 
+describe('private RPC runtime configuration', () => {
+  it('does not embed the RPC secret in build-time runtime defaults', async () => {
+    vi.stubEnv('ALBATROSS_RPC_NODE_URL', 'https://rpc.invalid/?token=build-secret')
+    vi.stubGlobal('defineNuxtConfig', (config: unknown) => config)
+
+    const { default: config } = await import('./nuxt.config')
+
+    expect(JSON.stringify(config.runtimeConfig)).not.toContain('build-secret')
+  })
+})
+
 describe('score v2 runtime configuration', () => {
   it('uses the Nitro-compatible NUXT_SCORE_V2_MODE environment variable', async () => {
     vi.stubEnv('NUXT_SCORE_V2_MODE', 'shadow')
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 595ea53..74fd04c 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -31,7 +31,7 @@ export default defineNuxtConfig({
   },
 
   runtimeConfig: {
-    albatrossRpcNodeUrl: process.env.ALBATROSS_RPC_NODE_URL || '',
+    albatrossRpcNodeUrl: '',
     scoreV2Mode: process.env.NUXT_SCORE_V2_MODE || 'off',
     slackWebhookUrl: process.env.NUXT_SLACK_WEBHOOK_URL || '',
     public: {
diff --git a/server/utils/rpc.test.ts b/server/utils/rpc.test.ts
new file mode 100644
index 0000000..7f090ff
--- /dev/null
+++ b/server/utils/rpc.test.ts
@@ -0,0 +1,21 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { getRpcUrl } from './rpc'
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+  vi.unstubAllGlobals()
+})
+
+describe('runtime RPC URL resolution', () => {
+  it.each([
+    { name: 'prefers the deployed secret over a stale runtime default', env: 'https://runtime-rpc.invalid', config: 'https://old-rpc.invalid', expected: 'https://runtime-rpc.invalid' },
+    { name: 'uses runtime config when the secret is missing', env: undefined, config: 'https://config-rpc.invalid', expected: 'https://config-rpc.invalid' },
+    { name: 'uses runtime config when the secret is empty', env: '', config: 'https://config-rpc.invalid', expected: 'https://config-rpc.invalid' },
+    { name: 'returns an empty URL when neither source is configured', env: undefined, config: '', expected: '' },
+  ])('$name', ({ env, config, expected }) => {
+    vi.stubEnv('ALBATROSS_RPC_NODE_URL', env)
+    vi.stubGlobal('useSafeRuntimeConfig', () => ({ albatrossRpcNodeUrl: config }))
+
+    expect(getRpcUrl()).toBe(expected)
+  })
+})
diff --git a/server/utils/rpc.ts b/server/utils/rpc.ts
index 434c7cb..dd93b32 100644
--- a/server/utils/rpc.ts
+++ b/server/utils/rpc.ts
@@ -1,5 +1,5 @@
 import process from 'node:process'
 
 export function getRpcUrl() {
-  return useSafeRuntimeConfig().albatrossRpcNodeUrl || process.env.ALBATROSS_RPC_NODE_URL || ''
+  return process.env.ALBATROSS_RPC_NODE_URL || useSafeRuntimeConfig().albatrossRpcNodeUrl || ''
 }