diff --git a/otc/observability.t09.de/stacks/core/dex/values.yaml b/otc/observability.t09.de/stacks/core/dex/values.yaml
index 1437ff7..5f9dad8 100644
--- a/otc/observability.t09.de/stacks/core/dex/values.yaml
+++ b/otc/observability.t09.de/stacks/core/dex/values.yaml
@@ -68,9 +68,9 @@ config:
       name: ArgoCD Client
       redirectURIs:
         - "http://argocd.observability.t09.de/auth/callback"
-      secret: "{{`{{ .Env.OIDC_DEX_ARGO_CLIENT_SECRET }}`}}"
+      secretEnv: "OIDC_DEX_ARGO_CLIENT_SECRET"
     - id: grafana
       redirectURIs:
         - "https://grafana.observability.t09.de/login/generic_oauth"
       name: "Grafana"
-      secret: "thisisasecret"
+      secretEnv: "OIDC_DEX_GRAFANA_CLIENT_SECRET"
diff --git a/otc/observability.t09.de/stacks/observability/grafana-operator/manifests/grafana.yaml b/otc/observability.t09.de/stacks/observability/grafana-operator/manifests/grafana.yaml
index 05b6116..21da68e 100644
--- a/otc/observability.t09.de/stacks/observability/grafana-operator/manifests/grafana.yaml
+++ b/otc/observability.t09.de/stacks/observability/grafana-operator/manifests/grafana.yaml
@@ -53,7 +53,7 @@ spec:
       allow_sign_up: "true"
       use_refresh_token: "true"
       client_id: grafana
-      client_secret: "thisisasecret" # $__file{/etc/secrets/auth_generic_oauth/client_secret}
+      client_secret: "grafana123" # $__file{/etc/secrets/auth_generic_oauth/client_secret}
       scopes: openid email profile offline_access groups
       auth_url: https://dex.observability.t09.de/auth
       token_url: https://dex.observability.t09.de/token