diff --git a/charts/gha-runner-scale-set-dev/tests/github_secret_annotations_test.yaml b/charts/gha-runner-scale-set-dev/tests/github_secret_annotations_test.yaml
new file mode 100644
index 00000000..8b195ca8
--- /dev/null
+++ b/charts/gha-runner-scale-set-dev/tests/github_secret_annotations_test.yaml
@@ -0,0 +1,49 @@
+suite: "Test GitHub Secret Annotations"
+templates:
+  - githubsecret.yaml
+tests:
+  - it: should include global annotations
+    set:
+      scaleset.name: "test"
+      auth.url: "https://github.com/org"
+      auth.githubToken: "gh_token12345"
+      resource:
+        all:
+          metadata:
+            annotations:
+              a: "global"
+              shared: "global"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - equal:
+          path: metadata.annotations.a
+          value: "global"
+      - equal:
+          path: metadata.annotations.shared
+          value: "global"
+
+  - it: should drop actions.github.com annotations from global config
+    set:
+      scaleset.name: "test"
+      auth.url: "https://github.com/org"
+      auth.githubToken: "gh_token12345"
+      resource:
+        all:
+          metadata:
+            annotations:
+              ok: "ok"
+              actions.github.com/values-hash: "user-value"
+              actions.github.com/cleanup-something: "should-not-render"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - equal:
+          path: metadata.annotations.ok
+          value: "ok"
+      - notExists:
+          path: metadata.annotations["actions.github.com/values-hash"]
+      - notExists:
+          path: metadata.annotations["actions.github.com/cleanup-something"]
diff --git a/charts/gha-runner-scale-set-dev/tests/github_secret_app_test.yaml b/charts/gha-runner-scale-set-dev/tests/github_secret_app_test.yaml
new file mode 100644
index 00000000..b1dece00
--- /dev/null
+++ b/charts/gha-runner-scale-set-dev/tests/github_secret_app_test.yaml
@@ -0,0 +1,70 @@
+suite: "Test GitHub Secret Data"
+templates:
+  - githubsecret.yaml
+tests:
+  - it: should render PAT token when configured
+    set:
+      scaleset.name: "test"
+      auth.url: "https://github.com/org"
+      auth.githubToken: "gh_token12345"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - exists:
+          path: data.github_token
+      - equal:
+          path: data.github_token
+          value: "Z2hfdG9rZW4xMjM0NQ=="
+      - notExists:
+          path: data.github_app_id
+      - notExists:
+          path: data.github_app_installation_id
+      - notExists:
+          path: data.github_app_private_key
+
+  - it: should render GitHub App keys when app is configured
+    set:
+      scaleset.name: "test"
+      auth.url: "https://github.com/org"
+      auth.app:
+        clientId: "123"
+        installationId: "456"
+        privateKey: "mykey"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - notExists:
+          path: data.github_token
+      - equal:
+          path: data.github_app_id
+          value: "MTIz"
+      - equal:
+          path: data.github_app_installation_id
+          value: "NDU2"
+      - equal:
+          path: data.github_app_private_key
+          value: "bXlrZXk="
+
+  - it: should fail if app is configured without installationId
+    set:
+      scaleset.name: "test"
+      auth.url: "https://github.com/org"
+      auth.app:
+        clientId: "123"
+        privateKey: "mykey"
+    asserts:
+      - failedTemplate:
+          errorMessage: ".Values.auth.app.installationId is required when using GitHub App auth"
+
+  - it: should fail if app is configured without privateKey
+    set:
+      scaleset.name: "test"
+      auth.url: "https://github.com/org"
+      auth.app:
+        clientId: "123"
+        installationId: "456"
+    asserts:
+      - failedTemplate:
+          errorMessage: ".Values.auth.app.privateKey is required when using GitHub App auth"