diff --git a/app/Controllers/Setting/HealthplixSettings.php b/app/Controllers/Setting/HealthplixSettings.php
index f147515..7efb724 100644
--- a/app/Controllers/Setting/HealthplixSettings.php
+++ b/app/Controllers/Setting/HealthplixSettings.php
@@ -82,9 +82,13 @@ class HealthplixSettings extends BaseController
             ]);
         }
 
+        $storedFetchSecret = $this->readSettingValue('HEALTHPLIX_FETCH_SECRET');
+
         return $this->response->setJSON([
             'update' => 1,
             'error_text' => 'Saved ' . $savedCount . ' setting(s)',
+            'healthplixFetchSecretConfigured' => $storedFetchSecret !== '',
+            'healthplixFetchSecretMasked' => $this->maskKey($storedFetchSecret),
             'csrfName' => csrf_token(),
             'csrfHash' => csrf_hash(),
         ]);
diff --git a/app/Views/Setting/Admin/healthplix_settings.php b/app/Views/Setting/Admin/healthplix_settings.php
index 4905e96..079886e 100644
--- a/app/Views/Setting/Admin/healthplix_settings.php
+++ b/app/Views/Setting/Admin/healthplix_settings.php
@@ -136,6 +136,16 @@
         $('#healthplix_settings_msg').html('<div class="' + cls + '">' + $('<div>').text(text || '').html() + '</div>');
     }
 
+    function updateFetchSecretHintFromServer(data) {
+        if (data && data.healthplixFetchSecretConfigured) {
+            var maskedSecret = data.healthplixFetchSecretMasked || '********';
+            $('#healthplix_fetch_secret_hint').html('<span class="text-success">&#10003; Secret saved (' + $('<div>').text(maskedSecret).html() + '). Leave blank to keep existing.</span>');
+            return;
+        }
+
+        $('#healthplix_fetch_secret_hint').html('<span class="text-muted">No callback secret configured yet.</span>');
+    }
+
     function postJson(url, payload, cb) {
         var csrf = getCsrfPair();
         payload = payload || {};
@@ -203,13 +213,7 @@
                 $('#healthplix_tenant_key_hint').html('<span class="text-muted">Leave blank to keep existing key.</span>');
             }
 
-            var savedSecret = ($('#healthplix_fetch_secret').val() || '').trim();
-            if (savedSecret.length > 0) {
-                var maskedSecret = savedSecret.length <= 8 ? '********' : (savedSecret.substring(0, 4) + '****' + savedSecret.slice(-4));
-                $('#healthplix_fetch_secret_hint').html('<span class="text-success">&#10003; Secret saved (' + maskedSecret + '). Leave blank to keep existing.</span>');
-            } else {
-                $('#healthplix_fetch_secret_hint').html('<span class="text-muted">Leave blank to keep existing callback secret.</span>');
-            }
+            updateFetchSecretHintFromServer(data);
 
             $('#healthplix_tenant_key').val('');
             $('#healthplix_fetch_secret').val('');