diff --git a/services/platform/app/components/env/env-var-list-editor.tsx b/services/platform/app/components/env/env-var-list-editor.tsx
index 2ad0edb38..ee056cf01 100644
--- a/services/platform/app/components/env/env-var-list-editor.tsx
+++ b/services/platform/app/components/env/env-var-list-editor.tsx
@@ -14,11 +14,11 @@ import { Button } from '@tale/ui/button';
 import { Checkbox } from '@tale/ui/checkbox';
 import { Input } from '@tale/ui/input';
 import { HStack, VStack } from '@tale/ui/layout';
-import { SkeletonText } from '@tale/ui/skeleton';
-import { Text } from '@tale/ui/text';
+import { Table, TableBody, TableCell, TableRow } from '@tale/ui/table';
 import { Plus, Trash2 } from 'lucide-react';
 import { useEffect, useRef, useState } from 'react';
 
+import { DeleteDialog } from '@/app/components/ui/dialog/delete-dialog';
 import { Select } from '@/app/components/ui/forms/select';
 import { toast } from '@/app/hooks/use-toast';
 import { useT } from '@/lib/i18n/client';
@@ -132,6 +132,8 @@ export function EnvVarListEditor({
 
   const [localRows, setLocalRows] = useState<Row[]>([]);
   const [saving, setSaving] = useState(false);
+  // Index of the row awaiting remove confirmation (null = no dialog open).
+  const [pendingRemove, setPendingRemove] = useState<number | null>(null);
   // While the user has unsaved edits, server (re)loads must not clobber them.
   // After a save we clear this so the post-write reactive update re-snapshots
   // with the freshly-computed secret previews.
@@ -172,6 +174,22 @@ export function EnvVarListEditor({
     dirty.current = true;
     setLocalRows((rs) => rs.filter((_, j) => j !== i));
   };
+  // A blank, never-saved row carries no data — drop it immediately. Any row with
+  // content (a typed key, or one loaded from the server) goes through a
+  // confirmation modal before it's removed.
+  const requestRemove = (i: number): void => {
+    const r = localRows[i];
+    if (r && r.existingKey === null && r.key.trim() === '') {
+      removeRow(i);
+      return;
+    }
+    setPendingRemove(i);
+  };
+  const confirmRemove = (): void => {
+    if (pendingRemove === null) return;
+    removeRow(pendingRemove);
+    setPendingRemove(null);
+  };
 
   const onSave = async (): Promise<void> => {
     const active = localRows.filter((r) => r.key.trim() !== '');
@@ -230,158 +248,169 @@ export function EnvVarListEditor({
 
   const busy = saving || disabled;
 
-  if (isLoading && localRows.length === 0) {
-    return <SkeletonText lines={3} />;
-  }
-
-  return (
-    <VStack gap={2}>
-      {localRows.length === 0 && (
-        <Text variant="muted" className="text-sm">
-          {t('none')}
-        </Text>
-      )}
-      {localRows.map((r, i) => {
-        const isBinding = r.tokenSourceSlug !== undefined;
-        // When the surface supports token sources, a single per-row "type"
-        // chooser (Value / Secret / a source) replaces the Secret checkbox —
-        // the user picks ONE: type a value, or draw from a rotating pool. The
-        // value field shows only for Value/Secret. Surfaces without sources keep
-        // the plain value + Secret-checkbox layout.
-        const hasSources =
-          tokenSources !== undefined && tokenSources.length > 0;
-        const rowType = isBinding
-          ? 'token-source'
-          : r.isSecret
-            ? 'secret'
-            : 'value';
-        const onTypeChange = (v: string): void => {
-          if (!v) return; // ignore Radix's spurious '' during flux
-          if (v === 'value') {
-            patch(i, {
-              isSecret: false,
-              tokenSourceSlug: undefined,
-              masked: false,
-              ...(r.isSecret && { secretDirty: true, value: '' }),
-            });
-          } else if (v === 'secret') {
-            patch(i, {
-              isSecret: true,
-              secretDirty: true,
-              tokenSourceSlug: undefined,
-              ...(r.masked && { value: '', masked: false }),
-            });
-          } else if (v === 'token-source') {
-            // Default to the first source; the second dropdown lets the user
-            // change it. (Only reachable when hasSources, so [0] exists.)
-            const firstSlug = tokenSources?.[0]?.slug;
-            if (firstSlug !== undefined) {
-              patch(i, {
-                tokenSourceSlug: firstSlug,
-                isSecret: true,
-                value: '',
-                masked: false,
-                secretDirty: false,
-              });
-            }
-          }
-        };
-        return (
-          <HStack key={i} gap={2} className="items-center">
+  // Headerless, no-skeleton, no-empty-state table (#1950): when there are no
+  // rows the table isn't rendered at all — only the Add/Save controls remain.
+  const renderRow = (r: Row, i: number) => {
+    const isBinding = r.tokenSourceSlug !== undefined;
+    // When the surface supports token sources, a single per-row "type"
+    // chooser (Value / Secret / a source) replaces the Secret checkbox —
+    // the user picks ONE: type a value, or draw from a rotating pool. The
+    // value field shows only for Value/Secret. Surfaces without sources keep
+    // the plain value + Secret-checkbox layout.
+    const hasSources = tokenSources !== undefined && tokenSources.length > 0;
+    const rowType = isBinding
+      ? 'token-source'
+      : r.isSecret
+        ? 'secret'
+        : 'value';
+    const onTypeChange = (v: string): void => {
+      if (!v) return; // ignore Radix's spurious '' during flux
+      if (v === 'value') {
+        patch(i, {
+          isSecret: false,
+          tokenSourceSlug: undefined,
+          masked: false,
+          ...(r.isSecret && { secretDirty: true, value: '' }),
+        });
+      } else if (v === 'secret') {
+        patch(i, {
+          isSecret: true,
+          secretDirty: true,
+          tokenSourceSlug: undefined,
+          ...(r.masked && { value: '', masked: false }),
+        });
+      } else if (v === 'token-source') {
+        // Default to the first source; the second dropdown lets the user
+        // change it. (Only reachable when hasSources, so [0] exists.)
+        const firstSlug = tokenSources?.[0]?.slug;
+        if (firstSlug !== undefined) {
+          patch(i, {
+            tokenSourceSlug: firstSlug,
+            isSecret: true,
+            value: '',
+            masked: false,
+            secretDirty: false,
+          });
+        }
+      }
+    };
+    return (
+      <TableRow key={i} data-no-hover>
+        <TableCell className="w-48 align-middle">
+          <Input
+            placeholder={t('keyPlaceholder')}
+            value={r.key}
+            disabled={busy}
+            className="font-mono"
+            onChange={(e) => patch(i, { key: e.target.value })}
+          />
+        </TableCell>
+        {hasSources && (
+          <TableCell className="w-0 align-middle">
+            <Select
+              aria-label={t('valueType')}
+              className="w-40 shrink-0"
+              disabled={busy}
+              value={rowType}
+              options={[
+                { value: 'value', label: t('typeValue') },
+                { value: 'secret', label: t('secret') },
+                { value: 'token-source', label: t('typeTokenSource') },
+              ]}
+              onValueChange={onTypeChange}
+            />
+          </TableCell>
+        )}
+        <TableCell className="align-middle">
+          {isBinding ? (
+            // Second dropdown: WHICH token source (shown only once the type
+            // is "Token source"). Keeps sources out of the type list.
+            <Select
+              aria-label={t('typeTokenSource')}
+              className="w-full"
+              disabled={busy}
+              value={r.tokenSourceSlug ?? ''}
+              options={(tokenSources ?? []).map((s) => ({
+                value: s.slug,
+                label: s.displayName,
+              }))}
+              onValueChange={(v) => {
+                if (v) patch(i, { tokenSourceSlug: v });
+              }}
+            />
+          ) : (
             <Input
-              placeholder={t('keyPlaceholder')}
-              value={r.key}
+              type={r.isSecret && !r.masked ? 'password' : 'text'}
+              placeholder={t('valuePlaceholder')}
+              value={r.value}
               disabled={busy}
               className="font-mono"
-              onChange={(e) => patch(i, { key: e.target.value })}
+              onFocus={() => {
+                if (r.masked) patch(i, { value: '', masked: false });
+              }}
+              onChange={(e) =>
+                patch(i, {
+                  value: e.target.value,
+                  masked: false,
+                  ...(r.isSecret && { secretDirty: true }),
+                })
+              }
+              onBlur={() => {
+                if (
+                  r.isSecret &&
+                  r.existingKey !== null &&
+                  !r.secretDirty &&
+                  r.value === ''
+                ) {
+                  patch(i, { value: r.maskedDisplay, masked: true });
+                }
+              }}
             />
-            {hasSources && (
-              <Select
-                aria-label={t('valueType')}
-                className="w-40 shrink-0"
-                disabled={busy}
-                value={rowType}
-                options={[
-                  { value: 'value', label: t('typeValue') },
-                  { value: 'secret', label: t('secret') },
-                  { value: 'token-source', label: t('typeTokenSource') },
-                ]}
-                onValueChange={onTypeChange}
-              />
-            )}
-            {isBinding ? (
-              // Second dropdown: WHICH token source (shown only once the type is
-              // "Token source"). Keeps sources out of the type list.
-              <Select
-                aria-label={t('typeTokenSource')}
-                className="flex-1"
-                disabled={busy}
-                value={r.tokenSourceSlug ?? ''}
-                options={(tokenSources ?? []).map((s) => ({
-                  value: s.slug,
-                  label: s.displayName,
-                }))}
-                onValueChange={(v) => {
-                  if (v) patch(i, { tokenSourceSlug: v });
-                }}
-              />
-            ) : (
-              <Input
-                type={r.isSecret && !r.masked ? 'password' : 'text'}
-                placeholder={t('valuePlaceholder')}
-                value={r.value}
+          )}
+        </TableCell>
+        {!hasSources && (
+          <TableCell className="w-0 align-middle">
+            <label className="text-muted-foreground flex shrink-0 items-center gap-1.5 text-xs">
+              <Checkbox
+                checked={r.isSecret}
                 disabled={busy}
-                className="font-mono"
-                onFocus={() => {
-                  if (r.masked) patch(i, { value: '', masked: false });
-                }}
-                onChange={(e) =>
+                onCheckedChange={(c) =>
                   patch(i, {
-                    value: e.target.value,
-                    masked: false,
-                    ...(r.isSecret && { secretDirty: true }),
+                    isSecret: c === true,
+                    secretDirty: true,
+                    ...(r.masked && { value: '', masked: false }),
                   })
                 }
-                onBlur={() => {
-                  if (
-                    r.isSecret &&
-                    r.existingKey !== null &&
-                    !r.secretDirty &&
-                    r.value === ''
-                  ) {
-                    patch(i, { value: r.maskedDisplay, masked: true });
-                  }
-                }}
               />
-            )}
-            {!hasSources && (
-              <label className="text-muted-foreground flex shrink-0 items-center gap-1.5 text-xs">
-                <Checkbox
-                  checked={r.isSecret}
-                  disabled={busy}
-                  onCheckedChange={(c) =>
-                    patch(i, {
-                      isSecret: c === true,
-                      secretDirty: true,
-                      ...(r.masked && { value: '', masked: false }),
-                    })
-                  }
-                />
-                {t('secret')}
-              </label>
-            )}
-            <Button
-              size="icon"
-              variant="ghost"
-              disabled={busy}
-              aria-label={t('remove')}
-              onClick={() => removeRow(i)}
-            >
-              <Trash2 className="size-4" />
-            </Button>
-          </HStack>
-        );
-      })}
+              {t('secret')}
+            </label>
+          </TableCell>
+        )}
+        <TableCell className="w-0 align-middle">
+          <Button
+            size="icon"
+            variant="ghost"
+            disabled={busy}
+            aria-label={t('remove')}
+            onClick={() => requestRemove(i)}
+          >
+            <Trash2 className="size-4" />
+          </Button>
+        </TableCell>
+      </TableRow>
+    );
+  };
+
+  const pendingRow =
+    pendingRemove !== null ? localRows[pendingRemove] : undefined;
+
+  return (
+    <VStack gap={2}>
+      {localRows.length > 0 && (
+        <Table>
+          <TableBody>{localRows.map((r, i) => renderRow(r, i))}</TableBody>
+        </Table>
+      )}
       <HStack gap={2} className="justify-between">
         <Button
           variant="ghost"
@@ -396,6 +425,21 @@ export function EnvVarListEditor({
           {saving ? t('saving') : t('save')}
         </Button>
       </HStack>
+      <DeleteDialog
+        open={pendingRemove !== null}
+        onOpenChange={(open) => {
+          if (!open) setPendingRemove(null);
+        }}
+        title={t('confirmRemoveTitle')}
+        description={t('confirmRemoveDescription')}
+        preview={
+          pendingRow
+            ? { primary: pendingRow.key.trim() || t('keyPlaceholder') }
+            : undefined
+        }
+        deleteText={t('remove')}
+        onDelete={confirmRemove}
+      />
     </VStack>
   );
 }
diff --git a/services/platform/app/features/settings/account/components/passkey-section.tsx b/services/platform/app/features/settings/account/components/passkey-section.tsx
index 686116a95..353616d40 100644
--- a/services/platform/app/features/settings/account/components/passkey-section.tsx
+++ b/services/platform/app/features/settings/account/components/passkey-section.tsx
@@ -1,11 +1,12 @@
 'use client';
 
 import { Button } from '@tale/ui/button';
-import { HStack, Stack, VStack } from '@tale/ui/layout';
-import { Text } from '@tale/ui/text';
+import { Table, TableBody, TableCell, TableRow } from '@tale/ui/table';
 import { useQuery, useQueryClient } from '@tanstack/react-query';
+import { Trash2 } from 'lucide-react';
 import { useState } from 'react';
 
+import { DeleteDialog } from '@/app/components/ui/dialog/delete-dialog';
 import { SettingsSection } from '@/app/features/settings/components/settings-section';
 import { useConvexQuery } from '@/app/hooks/use-convex-query';
 import { useToast } from '@/app/hooks/use-toast';
@@ -43,6 +44,9 @@ export function PasskeySection() {
   const { data: status } = useConvexQuery(api.two_factor.queries.getStatus, {});
 
   const [registerDialogOpen, setRegisterDialogOpen] = useState(false);
+  // The passkey awaiting revoke confirmation (null = no dialog open).
+  const [pendingRevoke, setPendingRevoke] = useState<PasskeyRow | null>(null);
+  const [revoking, setRevoking] = useState(false);
 
   const { data: passkeys, isLoading } = useQuery({
     queryKey: PASSKEYS_QUERY_KEY,
@@ -62,9 +66,13 @@ export function PasskeySection() {
     void queryClient.invalidateQueries({ queryKey: PASSKEYS_QUERY_KEY });
   }
 
-  async function revoke(id: string) {
+  async function confirmRevoke() {
+    if (!pendingRevoke) return;
+    setRevoking(true);
     try {
-      const result = await authClient.passkey.deletePasskey({ id });
+      const result = await authClient.passkey.deletePasskey({
+        id: pendingRevoke.id,
+      });
       if (result?.error) {
         toast({
           title: t('passkeys.errors.revokeFailed'),
@@ -74,11 +82,14 @@ export function PasskeySection() {
       }
       toast({ title: t('passkeys.revoked'), variant: 'success' });
       invalidate();
+      setPendingRevoke(null);
     } catch {
       toast({
         title: t('passkeys.errors.revokeFailed'),
         variant: 'destructive',
       });
+    } finally {
+      setRevoking(false);
     }
   }
 
@@ -94,32 +105,49 @@ export function PasskeySection() {
       }
     >
       {!isLoading && passkeys && passkeys.length > 0 && (
-        <Stack gap={2}>
-          {passkeys.map((pk) => (
-            <HStack
-              key={pk.id}
-              justify="between"
-              align="center"
-              className="rounded-md border px-3 py-2"
-            >
-              <VStack gap={0} className="min-w-0">
-                <Text className="truncate text-sm font-medium">
-                  {pk.name?.trim() || t('passkeys.unnamed')}
-                </Text>
-              </VStack>
-              <Button variant="ghost" onClick={() => revoke(pk.id)}>
-                {t('passkeys.revokeButton')}
-              </Button>
-            </HStack>
-          ))}
-        </Stack>
+        <Table>
+          <TableBody>
+            {passkeys.map((pk) => (
+              <TableRow key={pk.id}>
+                <TableCell className="text-sm font-medium">
+                  <span className="block truncate">
+                    {pk.name?.trim() || t('passkeys.unnamed')}
+                  </span>
+                </TableCell>
+                <TableCell className="w-0 text-right">
+                  <Button
+                    size="icon"
+                    variant="ghost"
+                    aria-label={t('passkeys.revokeButton')}
+                    onClick={() => setPendingRevoke(pk)}
+                  >
+                    <Trash2 className="size-4" />
+                  </Button>
+                </TableCell>
+              </TableRow>
+            ))}
+          </TableBody>
+        </Table>
       )}
 
-      {!isLoading && (!passkeys || passkeys.length === 0) && (
-        <Text variant="muted" className="text-sm">
-          {t('passkeys.empty')}
-        </Text>
-      )}
+      <DeleteDialog
+        open={pendingRevoke !== null}
+        onOpenChange={(open) => {
+          if (!open && !revoking) setPendingRevoke(null);
+        }}
+        title={t('passkeys.confirmRevokeTitle')}
+        description={t('passkeys.confirmRevokeDescription')}
+        preview={
+          pendingRevoke
+            ? {
+                primary: pendingRevoke.name?.trim() || t('passkeys.unnamed'),
+              }
+            : undefined
+        }
+        deleteText={t('passkeys.revokeButton')}
+        isDeleting={revoking}
+        onDelete={() => void confirmRevoke()}
+      />
 
       <PasskeyRegisterDialog
         open={registerDialogOpen}
diff --git a/services/platform/messages/de.json b/services/platform/messages/de.json
index e59e126c8..6e7e843cf 100644
--- a/services/platform/messages/de.json
+++ b/services/platform/messages/de.json
@@ -6925,7 +6925,8 @@
       "description": "Melde dich mit einem Passkey an (Face ID, Touch ID, Windows Hello oder ein Security-Key). Ein Passkey ist phishing-resistent und erfüllt die Zwei-Faktor-Anforderung deiner Organisation.",
       "addButton": "Passkey hinzufügen",
       "revokeButton": "Entfernen",
-      "empty": "Noch keine Passkeys registriert.",
+      "confirmRevokeTitle": "Passkey entfernen?",
+      "confirmRevokeDescription": "Du kannst dich dann nicht mehr mit diesem Passkey anmelden. Dies kann nicht rückgängig gemacht werden.",
       "unnamed": "Passkey",
       "registered": "Passkey registriert",
       "revoked": "Passkey entfernt",
@@ -7786,7 +7787,8 @@
     "accessDenied": "Sie benötigen Entwickler- oder Admin-Zugriff, um Sandboxes zu verwalten."
   },
   "envEditor": {
-    "none": "Noch keine Umgebungsvariablen.",
+    "confirmRemoveTitle": "Variable entfernen?",
+    "confirmRemoveDescription": "Sie wird beim Speichern deiner Änderungen entfernt. Dies kann nicht rückgängig gemacht werden.",
     "keyPlaceholder": "NAME",
     "valuePlaceholder": "Wert",
     "secret": "Geheim",
diff --git a/services/platform/messages/en.json b/services/platform/messages/en.json
index fc09ec3de..cd530ba55 100644
--- a/services/platform/messages/en.json
+++ b/services/platform/messages/en.json
@@ -7187,7 +7187,8 @@
       "description": "Sign in with a passkey (Face ID, Touch ID, Windows Hello, or a security key). A passkey is phishing-resistant and satisfies your organization's two-factor requirement.",
       "addButton": "Add a passkey",
       "revokeButton": "Remove",
-      "empty": "No passkeys registered yet.",
+      "confirmRevokeTitle": "Remove passkey?",
+      "confirmRevokeDescription": "You'll no longer be able to sign in with this passkey. This can't be undone.",
       "unnamed": "Passkey",
       "registered": "Passkey registered",
       "revoked": "Passkey removed",
@@ -7786,7 +7787,8 @@
     "accessDenied": "You need developer or admin access to manage sandboxes."
   },
   "envEditor": {
-    "none": "No environment variables yet.",
+    "confirmRemoveTitle": "Remove variable?",
+    "confirmRemoveDescription": "It will be removed when you save your changes. This can't be undone.",
     "keyPlaceholder": "NAME",
     "valuePlaceholder": "value",
     "secret": "Secret",
diff --git a/services/platform/messages/fr.json b/services/platform/messages/fr.json
index e3bd63e2f..7e0788609 100644
--- a/services/platform/messages/fr.json
+++ b/services/platform/messages/fr.json
@@ -6926,7 +6926,8 @@
       "description": "Connecte-toi avec un passkey (Face ID, Touch ID, Windows Hello ou une clé de sécurité). Un passkey est résistant au phishing et satisfait l'exigence de double authentification de ton organisation.",
       "addButton": "Ajouter un passkey",
       "revokeButton": "Supprimer",
-      "empty": "Aucun passkey enregistré pour l'instant.",
+      "confirmRevokeTitle": "Supprimer le passkey ?",
+      "confirmRevokeDescription": "Tu ne pourras plus te connecter avec ce passkey. Cette action est irréversible.",
       "unnamed": "Passkey",
       "registered": "Passkey enregistré",
       "revoked": "Passkey supprimé",
@@ -7787,7 +7788,8 @@
     "accessDenied": "Vous avez besoin d’un accès développeur ou admin pour gérer les sandboxes."
   },
   "envEditor": {
-    "none": "Aucune variable d'environnement pour l'instant.",
+    "confirmRemoveTitle": "Supprimer la variable ?",
+    "confirmRemoveDescription": "Elle sera supprimée lorsque tu enregistreras tes modifications. Cette action est irréversible.",
     "keyPlaceholder": "NOM",
     "valuePlaceholder": "valeur",
     "secret": "Secret",