diff --git a/server/internal/api/serverscope.go b/server/internal/api/serverscope.go
index 268e883..5a0de78 100644
--- a/server/internal/api/serverscope.go
+++ b/server/internal/api/serverscope.go
@@ -300,6 +300,7 @@ var serverScopedRoutes = map[string]scopeDecl{
 	"DELETE /api/secrets/:group":      exempt,
 	"DELETE /api/secrets/:group/:key": exempt,
 	"POST /api/secrets/:group/reveal": exempt,
+	"GET /api/secrets/:group/values":  exempt,
 
 	// ---- status pages ----