diff --git a/lib/auth/session-secret.ts b/lib/auth/session-secret.ts
index aceff84f..4bc94a6c 100644
--- a/lib/auth/session-secret.ts
+++ b/lib/auth/session-secret.ts
@@ -23,7 +23,12 @@ export function getSessionSecret(): string {
   if (fromFile) return fromFile;
 
   const fromAdmin = configManager.get<string>('sessionSecret', '');
-  return fromAdmin || '';
+  if (fromAdmin) return fromAdmin;
+
+  const fromAdminFile = readFileEnv(
+    configManager.get<string>('sessionSecretFile', ''),
+  );
+  return fromAdminFile || "";
 }
 
 export function hasSessionSecret(): boolean {
diff --git a/lib/oauth/token-exchange.ts b/lib/oauth/token-exchange.ts
index 32f1956c..51fe2d21 100644
--- a/lib/oauth/token-exchange.ts
+++ b/lib/oauth/token-exchange.ts
@@ -19,6 +19,12 @@ export function getDiscoveryValidator(): EndpointValidator | undefined {
 function getGlobalClientSecret(): string {
   const adminSecret = configManager.get<string>('oauthClientSecret', '');
   if (adminSecret) return adminSecret;
+
+  const adminFileSecret = readFileEnv(
+    configManager.get<string>('oauthClientSecretFile', ''),
+  );
+  if (adminFileSecret) return adminFileSecret;
+
   return process.env.OAUTH_CLIENT_SECRET || readFileEnv(process.env.OAUTH_CLIENT_SECRET_FILE) || '';
 }