diff --git a/secrets/shelfmark.env b/secrets/shelfmark.env
new file mode 100644
index 0000000..f3460b6
Binary files /dev/null and b/secrets/shelfmark.env differ
diff --git a/services/calibre-web-automated.yml b/services/calibre-web-automated.yml
index 03cc621..90eb942 100644
--- a/services/calibre-web-automated.yml
+++ b/services/calibre-web-automated.yml
@@ -36,6 +36,8 @@ services:
   shelfmark:
     image: ghcr.io/calibrain/shelfmark:1.3.0
     container_name: shelfmark
+    env_file:
+      - ../secrets/shelfmark.env
     environment:
       TZ: ${TZ}
       PUID: ${PUID}
@@ -45,8 +47,8 @@ services:
       OIDC_AUTO_REDIRECT: true
       AUTH_METHOD: oidc
       OIDC_DISCOVERY_URL: https://authentik.kucharczyk.xyz/application/o/shelfmark/.well-known/openid-configuration
-      OIDC_CLIENT_ID: ke4aOPqcmal0MIhbMAZutFtpaNQjQwXegMzKCmrW
-      OIDC_CLIENT_SECRET: 4EbpJ1P0yAIpy6WcUUPFC4kSFo1Rkvf2hjAl9IlulR6vpZouaHgUNeFHBaiHtTCWSnjlyy2iGTwtDwL12PfETabzdYCCe0s7GL2Hx4XaoRffqk3dI7ApPCcQONIhuIo0
+      # shelfmark has no _FILE/secret support; OIDC_CLIENT_ID and
+      # OIDC_CLIENT_SECRET come from secrets/shelfmark.env (env_file below)
       OIDC_BUTTON_LABEL: Sign in with Authentik
     networks:
       public: