diff --git a/web/workspace/src/routes/w/[workspaceId]/settings/repository-access/+page.svelte b/web/workspace/src/routes/w/[workspaceId]/settings/repository-access/+page.svelte
index cf20ee0f0..56a35c826 100644
--- a/web/workspace/src/routes/w/[workspaceId]/settings/repository-access/+page.svelte
+++ b/web/workspace/src/routes/w/[workspaceId]/settings/repository-access/+page.svelte
@@ -730,9 +730,9 @@
                       {isPending(`copy-${credential.credential_id}`) ? 'Loading…' : copiedCredentialId === credential.credential_id ? 'Copied' : 'Copy public key'}
                     </button>
                     {#if credential.credential_id !== workspaceDefaultCredentialId}
-                      <button id={`rotate-credential-${credential.credential_id}`} type="button" class="secondary" disabled={credentialEditorPending() || isPending(`delete-${credential.credential_id}`)} onclick={() => void openCredentialRotation(credential)}>Rotate</button>
+                      <button id={`rotate-credential-${credential.credential_id}`} type="button" class="secondary" disabled={credentialEditorPending() || isPending(`copy-${credential.credential_id}`) || isPending(`delete-${credential.credential_id}`)} onclick={() => void openCredentialRotation(credential)}>Rotate</button>
                       {#if credential.referenced_repositories.length === 0}
-                        <button type="button" class="danger" disabled={isPending(`delete-${credential.credential_id}`) || isPending(`rotate-${credential.credential_id}`)} onclick={() => void deleteCredential(credential)}>Delete</button>
+                        <button type="button" class="danger" disabled={isPending(`delete-${credential.credential_id}`) || isPending(`copy-${credential.credential_id}`) || isPending(`rotate-${credential.credential_id}`)} onclick={() => void deleteCredential(credential)}>Delete</button>
                       {/if}
                     {/if}
                   </div>
diff --git a/web/workspace/src/routes/w/[workspaceId]/settings/repository-access/repository-access.browser.spec.ts b/web/workspace/src/routes/w/[workspaceId]/settings/repository-access/repository-access.browser.spec.ts
index 0b3e98332..68b204f30 100644
--- a/web/workspace/src/routes/w/[workspaceId]/settings/repository-access/repository-access.browser.spec.ts
+++ b/web/workspace/src/routes/w/[workspaceId]/settings/repository-access/repository-access.browser.spec.ts
@@ -240,6 +240,14 @@ test("keeps a deferred row failure on that row while unrelated actions remain en
       name: "Add pinned key",
     }) as HTMLButtonElement).disabled,
   ).toBe(false);
+  const rotate = within(row).getByRole("button", { name: "Rotate" });
+  const remove = within(row).getByRole("button", { name: "Delete" });
+  expect((rotate as HTMLButtonElement).disabled).toBe(true);
+  expect((remove as HTMLButtonElement).disabled).toBe(true);
+  await fireEvent.click(rotate);
+  await fireEvent.click(remove);
+  expect(screen.queryByRole("heading", { name: "Rotate Deploy key" }))
+    .toBeNull();
   await fireEvent.click(within(row).getByRole("button", { name: "Loading…" }));
   expect(fetchMock).toHaveBeenCalledTimes(1);