diff --git a/packages/system/keycloak/tests/admin_hostname_test.yaml b/packages/system/keycloak/tests/admin_hostname_test.yaml
new file mode 100644
index 000000000..9e8e5b34e
--- /dev/null
+++ b/packages/system/keycloak/tests/admin_hostname_test.yaml
@@ -0,0 +1,133 @@
+suite: admin hostname split (ingress.adminHost)
+
+release:
+  name: keycloak
+  namespace: cozy-keycloak
+
+# ingress.adminHost is an opt-in option that serves the Keycloak admin
+# console / admin REST API on a dedicated hostname (KC_HOSTNAME_ADMIN) and
+# routes it through an additional Ingress rule / HTTPRoute hostname to the
+# same keycloak-http service. Empty (default) keeps the admin console on the
+# main hostname and emits no admin-specific wiring.
+tests:
+  # --- StatefulSet env: KC_HOSTNAME_ADMIN ---
+  - it: does not set KC_HOSTNAME_ADMIN when adminHost is empty (default)
+    template: templates/sts.yaml
+    documentIndex: 1
+    set:
+      _cluster:
+        root-host: example.com
+    asserts:
+      - isKind:
+          of: StatefulSet
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: KC_HOSTNAME
+            value: https://keycloak.example.com
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: KC_HOSTNAME_ADMIN
+            value: https://keycloak-admin.example.com
+
+  - it: sets KC_HOSTNAME_ADMIN when adminHost is set
+    template: templates/sts.yaml
+    documentIndex: 1
+    set:
+      _cluster:
+        root-host: example.com
+      ingress:
+        adminHost: keycloak-admin.example.com
+    asserts:
+      - isKind:
+          of: StatefulSet
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: KC_HOSTNAME
+            value: https://keycloak.example.com
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: KC_HOSTNAME_ADMIN
+            value: https://keycloak-admin.example.com
+
+  # --- Ingress (gateway disabled) ---
+  - it: renders a single rule and single TLS entry when adminHost is empty
+    template: templates/ingress.yaml
+    set:
+      _cluster:
+        root-host: example.com
+    asserts:
+      - isKind:
+          of: Ingress
+      - lengthEqual:
+          path: spec.rules
+          count: 1
+      - equal:
+          path: spec.rules[0].host
+          value: keycloak.example.com
+      - lengthEqual:
+          path: spec.tls
+          count: 1
+
+  - it: renders a second rule and TLS entry for the admin hostname
+    template: templates/ingress.yaml
+    set:
+      _cluster:
+        root-host: example.com
+      ingress:
+        adminHost: keycloak-admin.example.com
+    asserts:
+      - lengthEqual:
+          path: spec.rules
+          count: 2
+      - equal:
+          path: spec.rules[1].host
+          value: keycloak-admin.example.com
+      - equal:
+          path: spec.rules[1].http.paths[0].backend.service.name
+          value: keycloak-http
+      - lengthEqual:
+          path: spec.tls
+          count: 2
+      - equal:
+          path: spec.tls[1].hosts[0]
+          value: keycloak-admin.example.com
+      - equal:
+          path: spec.tls[1].secretName
+          value: keycloak-admin-tls
+
+  # --- HTTPRoute (gateway enabled) ---
+  - it: renders a single hostname when adminHost is empty
+    template: templates/httproute.yaml
+    set:
+      _cluster:
+        root-host: example.com
+        gateway-enabled: "true"
+    asserts:
+      - isKind:
+          of: HTTPRoute
+      - lengthEqual:
+          path: spec.hostnames
+          count: 1
+      - equal:
+          path: spec.hostnames[0]
+          value: keycloak.example.com
+
+  - it: appends the admin hostname when adminHost is set
+    template: templates/httproute.yaml
+    set:
+      _cluster:
+        root-host: example.com
+        gateway-enabled: "true"
+      ingress:
+        adminHost: keycloak-admin.example.com
+    asserts:
+      - lengthEqual:
+          path: spec.hostnames
+          count: 2
+      - contains:
+          path: spec.hostnames
+          content: keycloak-admin.example.com