diff --git a/src/internal/controller/apiapp_controller.go b/src/internal/controller/apiapp_controller.go
index 36bed49..f090878 100644
--- a/src/internal/controller/apiapp_controller.go
+++ b/src/internal/controller/apiapp_controller.go
@@ -247,7 +247,7 @@ func (wr *wrappedAPIAppReconciler) reconcileKeys(ctx context.Context, ztdClient
 			"appId":    []byte(jsonKey.AppID),
 			"key":      []byte(jsonKey.Key),
 		}
-		secret, err := wr.Builder.BuildSecret(builder.SecretOpts{Immutable: true, Zitadel: nil, Key: key, Data: secretData}, wr.APIApp)
+		secret, err := wr.Builder.BuildSecret(builder.SecretOpts{Immutable: false, Zitadel: nil, Key: key, Data: secretData}, wr.APIApp)
 		if err != nil {
 			return fmt.Errorf("error building Secret: %v", err)
 		}