diff --git a/pkg/workflows/wasm/host/standard_test.go b/pkg/workflows/wasm/host/standard_test.go
index 61996ce40..69cf8a6ee 100644
--- a/pkg/workflows/wasm/host/standard_test.go
+++ b/pkg/workflows/wasm/host/standard_test.go
@@ -434,6 +434,39 @@ func TestStandardSecrets(t *testing.T) {
 	})
 }
 
+func TestStandardSecretsFailInNodeMode(t *testing.T) {
+	mockExecutionHelper := NewMockExecutionHelper(t)
+	mockExecutionHelper.EXPECT().GetWorkflowExecutionID().Return("id")
+	mockExecutionHelper.EXPECT().GetNodeTime().RunAndReturn(func() time.Time {
+		return time.Now()
+	}).Maybe()
+	mockExecutionHelper.EXPECT().GetDONTime().RunAndReturn(func() (time.Time, error) {
+		return time.Now(), nil
+	}).Maybe()
+	mockExecutionHelper.EXPECT().CallCapability(mock.Anything, mock.Anything).RunAndReturn(func(_ context.Context, request *sdk.CapabilityRequest) (*sdk.CapabilityResponse, error) {
+		assert.Equal(t, "consensus@1.0.0-alpha", request.Id)
+		input := &sdk.SimpleConsensusInputs{}
+		require.NoError(t, request.Payload.UnmarshalTo(input))
+
+		var errMsg string
+		switch msg := input.Observation.(type) {
+		case *sdk.SimpleConsensusInputs_Error:
+			errMsg = msg.Error
+		default:
+			require.Fail(t, "observation must be an error")
+		}
+		return &sdk.CapabilityResponse{
+			Response: &sdk.CapabilityResponse_Error{Error: errMsg},
+		}, nil
+	}).Once()
+	m := makeTestModule(t)
+	request := triggerExecuteRequest(t, 0, &basictrigger.Outputs{CoolOutput: anyTestTriggerValue})
+
+	errStr := executeWithError(t, m, request, mockExecutionHelper)
+
+	require.Contains(t, errStr, "cannot use Runtime inside RunInNodeMode")
+}
+
 func triggerExecuteRequest(t *testing.T, id uint64, trigger proto.Message) *sdk.ExecuteRequest {
 	wrappedTrigger, err := anypb.New(trigger)
 	require.NoError(t, err)
diff --git a/pkg/workflows/wasm/host/standard_tests/secrets_fail_in_node_mode/main_wasip1.go b/pkg/workflows/wasm/host/standard_tests/secrets_fail_in_node_mode/main_wasip1.go
new file mode 100644
index 000000000..ec8406f7a
--- /dev/null
+++ b/pkg/workflows/wasm/host/standard_tests/secrets_fail_in_node_mode/main_wasip1.go
@@ -0,0 +1,21 @@
+package main
+
+import (
+	"github.com/smartcontractkit/chainlink-common/pkg/workflows/wasm/host/internal/rawsdk"
+	"github.com/smartcontractkit/chainlink-protos/cre/go/sdk"
+)
+
+func main() {
+	// The real SDKs do something to capture the runtime.
+	// This is to mimic the mode switch calls they would make
+	rawsdk.SwitchModes(int32(sdk.Mode_MODE_NODE))
+
+	consensus := &sdk.SimpleConsensusInputs{
+		Observation: &sdk.SimpleConsensusInputs_Error{Error: "cannot use Runtime inside RunInNodeMode"},
+		Descriptors: &sdk.ConsensusDescriptor{Descriptor_: &sdk.ConsensusDescriptor_Aggregation{Aggregation: sdk.AggregationType_AGGREGATION_TYPE_IDENTICAL}},
+	}
+
+	err := rawsdk.DoRequestErr("consensus@1.0.0-alpha", "Simple", sdk.Mode_MODE_DON, consensus)
+	rawsdk.SwitchModes(int32(sdk.Mode_MODE_DON))
+	rawsdk.SendError(err)
+}