diff --git a/hosts/hitsugibune/immich.nix b/hosts/hitsugibune/immich.nix
index af2d81b..45c49d7 100644
--- a/hosts/hitsugibune/immich.nix
+++ b/hosts/hitsugibune/immich.nix
@@ -3,7 +3,7 @@ let
   domain = "immich.sprechtl.me";
 in
 {
-  age.secrets.immich = {
+  age.secrets.immich-oauth-secret = {
     file = ../../secrets/immich.age;
     owner = "immich";
     group = "immich";
@@ -19,7 +19,7 @@ in
         enabled = true;
         issuerUrl = "https://auth.sprechtl.me/application/o/immich/.well-known/openid-configuration";
         clientId = "EXMPaB2SoZYSSWu56ebB6CYV8W1hQS2eTwLdFBDw";
-        # clientSecret = ""; saved in secrets file
+        clientSecret._secret = config.age.secrets.immich-oauth-secret.path;
         scope = "openid email profile";
         buttonText = "Login with Authentik";
         autoRegister = true;
diff --git a/secrets/immich.age b/secrets/immich.age
index 2273d4c..c667228 100644
Binary files a/secrets/immich.age and b/secrets/immich.age differ