diff --git a/.github/workflows/ccm-integration-tests.yml b/.github/workflows/ccm-integration-tests.yml
index f5acd7c..7d5f16b 100644
--- a/.github/workflows/ccm-integration-tests.yml
+++ b/.github/workflows/ccm-integration-tests.yml
@@ -119,6 +119,33 @@ jobs:
             image.tar.sha256
           retention-days: 30d
 
+  check-ccm-integration:
+    # Preflight: verify the CLOUDSCALE_API_TOKEN at step-level and set an output
+    # so the integration job can be skipped.
+    #
+    # GitHub Actions limitations motivating this:
+    # - `secrets` are NOT available in `jobs.<id>.if` (job-level `if`), so you cannot
+    #   directly gate/skip a job by testing a secret there.
+    name: Check CCM Integration Configuration
+    runs-on: ubuntu-latest
+
+    outputs:
+      integration-enabled: ${{ steps.check.outputs.enabled }}
+
+    steps:
+      - id: check
+        name: Verify CLOUDSCALE_API_TOKEN is present
+        env:
+          CLOUDSCALE_API_TOKEN: ${{ secrets.CLOUDSCALE_API_TOKEN }}
+        run: |
+          if [ -n "$CLOUDSCALE_API_TOKEN" ]; then
+            echo "enabled=true" >> $GITHUB_OUTPUT
+            echo "CLOUDSCALE_API_TOKEN found — integration will run."
+          else
+            echo "enabled=false" >> $GITHUB_OUTPUT
+            echo "CLOUDSCALE_API_TOKEN not configured — skipping integration."
+          fi
+
   integration:
     name: "Kubernetes ${{ matrix.kubernetes }}"
     runs-on: ubuntu-latest
@@ -128,6 +155,8 @@ jobs:
       - unit
       - test-matrix
       - build-image
+      - check-ccm-integration
+    if: needs.check-ccm-integration.outputs.integration-enabled == 'true'
 
     strategy:
       fail-fast: false