diff --git a/secrets/jupiter.yaml b/secrets/jupiter.yaml
index 93b3371..7a8dd59 100644
--- a/secrets/jupiter.yaml
+++ b/secrets/jupiter.yaml
@@ -1,6 +1,6 @@
 samba_password: ENC[AES256_GCM,data:K3FtKC0CrOLMyfQokmxxlyUnDPo=,iv:9bTE/S/i05LJYldOHuBuz3+g8JdTuq0ysFFgXOmfti8=,tag:77NIxy7qpHRqCmbOR83AfA==,type:str]
 darman_password: ENC[AES256_GCM,data:DOHHlM4Qdw4WgkN+/M51n2LMjJqq5MS0FeGEH8Pz3297yUZ8jBDOKRS/Tek9stC05JKEQRtn/vVVbAY0nXs20MwrsDMo+IEFXx7Ms90vVyYIYe5O5/0aQkPq84vcwGN0RW1Rj5Y3s38vWA==,iv:DAqHbvOBq7FT7ALbmBXJ0HadEGEsL8V2e7R99H5ZH0s=,tag:9XpiRFIbaZjMn59uHCOA1g==,type:str]
-tailscale_authkey: ENC[AES256_GCM,data:GJjN9zdU3zNBxA8cEBdsmjDrj8G/m04r8JRCEDZkdd7jYplEHyLfhbMcIyZIBe3Sh4d3PM/PcKb191LZoMg/b1G4hiVwciaCoMY0O9kAhRg/aYHXluSIBQ==,iv:R3OsZ+3to0tBhF4IaaSHm0afkw5o0KfXkcTdT9HFucg=,tag:QQNXC9ya88lO087iGIc1sw==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:LjRXyFW1SbhUiXbCQnRKinJluGfQWsjS7TTP/TMvx2noP6aFNrcYMvitG+OqLAlNEQAy0bcxZejZgJN+yNS+5iuy2F7OXhrpO7Df0JHkyMvQpnaH2XBEsw==,iv:QxVkB6GtZOYWFAOFVdBQMU2Hb/2OwBRCLHdfxoDF/ME=,tag:PBL0TV6yZJSu4+TGpycf/A==,type:str]
 mediamanager_token_secret: ENC[AES256_GCM,data:g75vj1E6B029O076yV3DS/1z99Tq6wMhEVx+ULYDjHsplyA+vqVRvBlviC64V47IMqKd9k2eTGBJ98Ptv3UIjbr446xZinz0c7PZgHU0XOX4EUcB1ORloMFZIv1zUv8VRjUISUQnn/vRk60e7u8eXrOrgXjxfnoBKrdKZmqxhAM=,iv:2t0XBExC9RvbTomezka+99/LtJl64zNwneA7WWc4ju0=,tag:SVCYuw0n6JevnvoQOIkjPw==,type:str]
 sabnzbd_api_key: ENC[AES256_GCM,data:6UW1u2Ikmnq34t4H4k/4C44SJeFHRlaPjWwUjEfH1GQ=,iv:sGsd8Sd2pfUhTUDg6PlRzfVYejRbF69jmDTIa2fvY4M=,tag:3fOLgU1K1gKHxQ3J1+3oRQ==,type:str]
 prowlarr_api_key: ENC[AES256_GCM,data:ab1QACaagI8ACJXFUy8r9X9lgYwRo1byUmhBPSRWwKk=,iv:EcuF6EN/4mWxlXi6R1qDzv4rOw6AT+OGSNQaaBwjJHg=,tag:hixHrbQWU6QQZNMM5rNDsg==,type:str]
@@ -25,7 +25,7 @@ sops:
             CzjSDQZTcseEXZNwuzZcfB5Mvq0BQvjOj7lGuxzuE4qwWkdJWGfVLQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
-    lastmodified: "2026-07-18T00:02:37Z"
-    mac: ENC[AES256_GCM,data:By7/CkQ8bftrGzXwaD9gl1G/iV5AuJEnxHUAK1wMivzUj4mjTvtd3m/RaDd9aFuplNREKBAvUuH4WJ4RrrK+NTNqEsy+VUxch4n/3QC0TSjiEersJR8GpSbfa+AlZ7xNxS11AvV0NGW0PZzxIToR75Yn+hW4SoqeoLy+Nr3b+3U=,iv:sBdbOZl7JbzcR7kq0cyMxv9RATIzs0SheoC32H38iWA=,tag:XeL54IV5xK8+Oa7JhWPTkw==,type:str]
+    lastmodified: "2026-07-20T07:51:55Z"
+    mac: ENC[AES256_GCM,data:CBQrHpdIOn35CIrZaqZqZd/V4pp+bMNygXJoYwlOvwAtb49ElqmQgSZxWVgTKpTNZpMkqYie6HQB0c4vsmU/BYeLQKJNYBQvBxIrTQr4wMURj2jBMhtVT2osX5cUpNakoHZUdz6ARXyYGEVOBzMY77vSxk6VkVi5CFmeOETkcik=,iv:a6iTeIlR2S65pTrH+juS6kEhpbiaAmhcPLssasUPZ58=,tag:QP+LMclWU9SO5/uPI/Nwwg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1
diff --git a/secrets/neptun.yaml b/secrets/neptun.yaml
index 03e786f..e6029f1 100644
--- a/secrets/neptun.yaml
+++ b/secrets/neptun.yaml
@@ -2,10 +2,10 @@ darman_password: ENC[AES256_GCM,data:7G2Hgh13TxI6ugw2ebp9UtLTQ7HRC/hrCga0FmZo8h8
 authentik_secret_key: ENC[AES256_GCM,data:qLrAWBywlMqT6D3FYDqE9I/5Ep+zDVu9ns9TA4UVOBSQ1uFGEj01TU9norqPf12pi9/Qs32mVzm5BqDG259DxdGT9DZVQc03QVwiIQYtmWo=,iv:OVCIxIP1Xv+nHmYsrxaPgYWQiwzVPUe8pnbyMBVAuoI=,tag:+ywkwPqkY1Dkx1R5cUJ7PA==,type:str]
 authentik_bootstrap_email: ENC[AES256_GCM,data:OmqpKAiiFyS/rytnHYRZ,iv:VXiPV5VfduC/IW+E3gDlNAeE+hr+IZ9W7Ty6Npuu59Y=,tag:rjvTHnBxN/pMvpQC5W9S6Q==,type:str]
 authentik_bootstrap_password: ENC[AES256_GCM,data:QPCY0ni3jBQY5HyK+vRlyT4YTEo=,iv:41u1Jf+WYksPUY4pvKdHQA1RHW21GAfdVDRuQ7XtdYc=,tag:SYmzv26GbE1kwleXyKLG4Q==,type:str]
-tailscale_authkey: ENC[AES256_GCM,data:CBMidfdilBn1HP3TAu9TCOpuwPnzVQ/3OGCsf0vhFd8=,iv:V4UdZBPyzH8NkiXV40CxLdnfkCv5oG6xEQbNSmpmrmI=,tag:h8R2AIaFXgPycMIP8NyHVA==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:t8oKG+oSZrGF1Xb2YX7qWxo/z/dfsq/56kah/cvIdfQihuOSWNuMEWDcph1wlRCgRmNhQE8oqbO61m8xNQuOn+bNHsAEmh9GO9dt+uFuRKdwXJ2vM0nA+Q==,iv:6aq6buNvJ+Y0AUWBLNCdsl+svGGlXzpn5J3Oy7dPDys=,tag:T/lwzHUtyvcbjbKbu6jWeA==,type:str]
 headplane_cookie_secret: ENC[AES256_GCM,data:oXYRG4z16u6HS7zXoWrV2q/HL2o24n4UwVXnQvqBmbY=,iv:itAiy/w6ue4VzqO5xYnvSYN3uCLLmu52dvAAxZ2pCGc=,tag:MEFP171GpSQpAqUFsWY+VA==,type:str]
-headplane_oidc_client_secret: ENC[AES256_GCM,data:v86GLehXAI4Ol2ZxjtdtB1aDau0qsm68HBz3Iu4HjySPEi9jpg==,iv:EwtrNGKyVYcZg8AnD87EpHpmp0odeBXi1PM/9uUe+ko=,tag:VATaEMNxt5pnmgAHV13rLw==,type:str]
-headplane_headscale_api_key: ENC[AES256_GCM,data:pb2ipeI4rkTXMQMG6hbkSU7OBLcpYJ2/a+9TgSA7PAfL2tTFoDWico8=,iv:j3FkiixUbT+6oLREKP21jQGFFUUU2KqX/ym2xQCeM0k=,tag:ZulMJDpaM1c81yT/LWNWgA==,type:str]
+headplane_oidc_client_secret: ENC[AES256_GCM,data:RiEESz1WHYH/smlJKmKFpPoF5HRYp8gHJoKqc49xRRuU9WnQCnmETie/68u37sSVniQmQZSOmXxdmvuuJgP5LMcPdkrQmQE+QX80RQhtTVvg2AhqRaK4V+qfQleD/aJjoIHojeM3UBUi4kYOhDJF0FFTP+qR4oitH6W8/2jxRsc=,iv:hXquOglPhRv+QTVRw5fkY7BWuwLtJxK5tNERGBOOmt8=,tag:2KczveRWoq7iTOdwjO+AUw==,type:str]
+headplane_headscale_api_key: ENC[AES256_GCM,data:KcwcprV100wfAkn+YM4+1oTfXkmyeAMAbXNpQKf2iIq0VxwqVep+fORrKmHiwDViciDoyxdMiT4scGlmd4vQRsWEHdDpkuH7MRHYu0hQepE3rSSQAMbK,iv:NEhmi2hiOE+uSIRZ4uXOK1UGpN+FQx/NpooWzTgwik8=,tag:KcPsD4gp51ERaFwgfA0BrQ==,type:str]
 caddy_acme_email: ENC[AES256_GCM,data:j+iPz4lt0Gqs2SKHTS53,iv:DQNfcpYy2v93sKeCvXzLOoBhAo0PjZrxHgFD1oVqYu8=,tag:1yPH/2cW/IiRi9lT8dELEg==,type:str]
 sops:
     age:
@@ -27,7 +27,7 @@ sops:
             Wptkf76aP9UpjhgNkxzedRebQPB7ti+UiVqCvLVimtuHcsm/NJPcRg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
-    lastmodified: "2026-07-20T07:03:51Z"
-    mac: ENC[AES256_GCM,data:jWjdbICvAycAGEkl7r1rdTNfr62Xn4re1pJZU+4IifGW67fSRE0SN99lXCTj1B+WmhchzqBCf42n5D4c5dgQXo51bvWttjayRsUaqA9Hk/5T7QvFdjiNWbXpKsku1qe7VhoxhqzVoNXy/l9LvJTWYTRTStg3RYEmX0XpmbPIsCU=,iv:qCHahmqoHve0bejlssie6kA8zAABkwHV8gBF5hD8ab0=,tag:4MvjJ33QrDRfd4vYK7V7iw==,type:str]
+    lastmodified: "2026-07-20T08:15:48Z"
+    mac: ENC[AES256_GCM,data:yDiCTDaIwMCXZfzE4khI7AHNoYi3AHFX+nSXtioNRqLEOu1fBCA3OqHpzTi4Cskv2o7r9nlxx5AGPM+2d3bSHkXW7SJk680IMA/XzfDIKGU6A7+3NDt14/PgxOvPeVTfNWwlWIW9tXPtTVJmnoItTzPsxcLO3OyfbbO+vZhj/j4=,iv:xeqYTLjG0B6yCWoke0lulHetVNlShmw7Nm+8mmwOZ5I=,tag:JUEqRfEprzGMGoGsXp9rKQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1
diff --git a/services/vpn/headplane.nix b/services/vpn/headplane.nix
index e62edbd..600cd5c 100644
--- a/services/vpn/headplane.nix
+++ b/services/vpn/headplane.nix
@@ -53,7 +53,9 @@
 
     settings.oidc = {
       issuer = "https://auth.mgaction.town/application/o/headplane/";
-      client_id = "REPLACE_ME_authentik_client_id"; # not secret, but not known until the app exists in Authentik
+      # Not a secret — Authentik hands the client ID out at the authorize
+      # endpoint. Regenerating the provider in Authentik changes it.
+      client_id = "NNzYUrSBlCqxyCTfxlEJRpT5v5EQWHLpfOsXBine";
       client_secret_path = config.sops.secrets.headplane_oidc_client_secret.path;
       headscale_api_key_path = config.sops.secrets.headplane_headscale_api_key.path;
     };