diff --git a/app/(dashboard)/sse/page.tsx b/app/(dashboard)/sse/page.tsx
index 5d7f8b9..0297a0d 100644
--- a/app/(dashboard)/sse/page.tsx
+++ b/app/(dashboard)/sse/page.tsx
@@ -35,7 +35,7 @@ import { Field, FieldContent, FieldDescription, FieldGroup, FieldLabel } from "@
 import { Input } from "@/components/ui/input"
 import { Page } from "@/components/page"
 import { PageHeader } from "@/components/page-header"
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select"
+import { Select, SelectContent, SelectGroup, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select"
 import { Spinner } from "@/components/ui/spinner"
 import { Table, TableBody, TableCaption, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table"
 import { useSSE } from "@/hooks/use-sse"
@@ -993,7 +993,7 @@ export default function SSEPage() {
     local: t("Local filesystem"),
     "vault-kv2": t("HashiCorp Vault KV2"),
     "vault-transit": t("HashiCorp Vault Transit Engine"),
-    static: t("Static single-key (built-in)"),
+    static: t("Static single-key (built-in, dev/testing only)"),
   }
   const mutationLocked = Boolean(activeMutation || statusError || loadingStatus)
   const unsupportedKmsReadOnly = formState.backendType === "unsupported"
@@ -1229,17 +1229,19 @@ export default function SSEPage() {
                             </SelectValue>
                           </SelectTrigger>
                           <SelectContent>
-                            {formState.backendType === "unsupported" ? (
-                              <SelectItem value="unsupported" disabled>
-                                {t("Unsupported KMS backend")}
+                            <SelectGroup>
+                              {formState.backendType === "unsupported" ? (
+                                <SelectItem value="unsupported" disabled>
+                                  {t("Unsupported KMS backend")}
+                                </SelectItem>
+                              ) : null}
+                              <SelectItem value="local">{t("Local filesystem (dev/testing only)")}</SelectItem>
+                              <SelectItem value="vault-kv2">{t("HashiCorp Vault KV2")}</SelectItem>
+                              <SelectItem value="vault-transit">{t("HashiCorp Vault Transit Engine")}</SelectItem>
+                              <SelectItem value="static">
+                                {t("Static single-key (built-in, dev/testing only)")}
                               </SelectItem>
-                            ) : null}
-                            <SelectItem value="local">{t("Local filesystem (dev/testing only)")}</SelectItem>
-                            <SelectItem value="vault-kv2">{t("HashiCorp Vault KV2")}</SelectItem>
-                            <SelectItem value="vault-transit">{t("HashiCorp Vault Transit Engine")}</SelectItem>
-                            <SelectItem value="static">
-                              {t("Static single-key (built-in, dev/testing only)")}
-                            </SelectItem>
+                            </SelectGroup>
                           </SelectContent>
                         </Select>
                       </FieldContent>
diff --git a/tests/lib/sse-safety.test.js b/tests/lib/sse-safety.test.js
index 1f75767..68afd0f 100644
--- a/tests/lib/sse-safety.test.js
+++ b/tests/lib/sse-safety.test.js
@@ -85,6 +85,16 @@ test("unsupported KMS backends fail closed and require a current baseline before
   assert.match(source, /setConfigBaselineConflict\(null\)/)
 })
 
+test("KMS backend select renders translated labels before its popup opens", () => {
+  assert.match(source, /"vault-transit": t\("HashiCorp Vault Transit Engine"\)/)
+  assert.match(source, /static: t\("Static single-key \(built-in, dev\/testing only\)"\)/)
+  assert.match(
+    source,
+    /<SelectValue placeholder=\{t\("Select backend type"\)\}>\s*\{backendTypeLabels\[formState\.backendType\] \?\? null\}\s*<\/SelectValue>/,
+  )
+  assert.match(source, /<SelectContent>\s*<SelectGroup>[\s\S]*<SelectItem value="vault-transit">/)
+})
+
 test("SSE form and dialogs stay reachable on narrow screens", () => {
   assert.match(source, /<form\s+className="space-y-6"\s+noValidate/)
   assert.match(source, /<fieldset className="space-y-4 border-t pt-4">/)