diff --git a/e2e-tests/admin/pages/credential-stores.js b/e2e-tests/admin/pages/credential-stores.js
index a82044242..0eb6b8d6e 100644
--- a/e2e-tests/admin/pages/credential-stores.js
+++ b/e2e-tests/admin/pages/credential-stores.js
@@ -70,6 +70,47 @@ export class CredentialStoresPage extends BaseResourcePage {
     return credentialStoreName;
   }
 
+  /**
+   * Creates a vault credential store. Assumes you have selected the desired project.
+   * @param {string} vaultAddr address of the vault server
+   * @param {string} clientToken vault token to connect to boundary
+   * @param {string} workerFilter Worker filter for the Storage Bucket
+   * @returns Name of the credential store
+   */
+  async createVaultCredentialStoreWithWorkerFilter(
+    vaultAddr,
+    clientToken,
+    workerFilter,
+  ) {
+    const credentialStoreName = 'Credential Store ' + nanoid();
+    await this.page
+      .getByRole('navigation', { name: 'Resources' })
+      .getByRole('link', { name: 'Credential Stores' })
+      .click();
+    await this.page.getByRole('link', { name: 'New', exact: true }).click();
+    await this.page.getByLabel('Name (Optional)').fill(credentialStoreName);
+    await this.page.getByLabel('Description').fill('This is an automated test');
+    await this.page
+      .getByRole('group', { name: 'Type' })
+      .getByLabel('Vault')
+      .click();
+    await this.page.getByLabel('Address').fill(vaultAddr);
+    await this.page
+      .getByLabel('Worker filter')
+      .locator('textarea')
+      .fill(workerFilter);
+    await this.page.getByLabel('Token').fill(clientToken);
+    await this.page.getByRole('button', { name: 'Save' }).click();
+    await this.dismissSuccessAlert();
+    await expect(
+      this.page
+        .getByRole('navigation', { name: 'breadcrumbs' })
+        .getByText(credentialStoreName),
+    ).toBeVisible();
+
+    return credentialStoreName;
+  }
+
   /**
    * Creates a static key pair credential. Assumes you have selected the desired project.
    * @param {string} username username for the credential
diff --git a/e2e-tests/admin/tests/credential-store-vault-ent.spec.js b/e2e-tests/admin/tests/credential-store-vault-ent.spec.js
index 2a7a0225a..dcafd3de5 100644
--- a/e2e-tests/admin/tests/credential-store-vault-ent.spec.js
+++ b/e2e-tests/admin/tests/credential-store-vault-ent.spec.js
@@ -47,7 +47,8 @@ test(
     sshKeyPath,
     targetAddress,
     targetPort,
-    vaultAddr,
+    vaultAddrPrivate,
+    workerTagEgress,
   }) => {
     let orgId;
     let connect;
@@ -88,9 +89,10 @@ test(
         targetPort,
       );
       const credentialStoresPage = new CredentialStoresPage(page);
-      await credentialStoresPage.createVaultCredentialStore(
-        vaultAddr,
+      await credentialStoresPage.createVaultCredentialStoreWithWorkerFilter(
+        vaultAddrPrivate,
         clientToken,
+        `"${workerTagEgress}" in "/tags/type"`,
       );
       const credentialLibraryName =
         await credentialStoresPage.createVaultGenericCredentialLibraryEnt(
diff --git a/e2e-tests/global-setup.js b/e2e-tests/global-setup.js
index bf8560c55..4552fe672 100644
--- a/e2e-tests/global-setup.js
+++ b/e2e-tests/global-setup.js
@@ -83,6 +83,7 @@ export const test = baseTest.extend({
   sshUser: process.env.E2E_SSH_USER,
   targetAddress: process.env.E2E_TARGET_ADDRESS,
   targetPort: process.env.E2E_TARGET_PORT,
-  vaultAddr: process.env.E2E_VAULT_ADDR,
+  vaultAddr: process.env.E2E_VAULT_ADDR_PUBLIC,
+  vaultAddrPrivate: process.env.E2E_VAULT_ADDR_PRIVATE,
   workerTagEgress: process.env.E2E_WORKER_TAG_EGRESS,
 });