diff --git a/src/internal/controller/apiapp_controller.go b/src/internal/controller/apiapp_controller.go
index 84d9163..36bed49 100644
--- a/src/internal/controller/apiapp_controller.go
+++ b/src/internal/controller/apiapp_controller.go
@@ -175,7 +175,7 @@ func (wr *wrappedAPIAppReconciler) reconcileApp(ctx context.Context, ztdClient *
 	}
 
 	secretData := map[string][]byte{"client-secret": []byte(resp.ClientSecret)}
-	secret, err := wr.Builder.BuildSecret(builder.SecretOpts{Immutable: true, Zitadel: nil, Key: key, Data: secretData}, wr.APIApp)
+	secret, err := wr.Builder.BuildSecret(builder.SecretOpts{Immutable: false, Zitadel: nil, Key: key, Data: secretData}, wr.APIApp)
 	if err != nil {
 		return fmt.Errorf("error building Secret: %v", err)
 	}
diff --git a/src/internal/controller/oidcapp_controller.go b/src/internal/controller/oidcapp_controller.go
index 44476bb..0a9a1ee 100644
--- a/src/internal/controller/oidcapp_controller.go
+++ b/src/internal/controller/oidcapp_controller.go
@@ -186,7 +186,7 @@ func (wr *wrappedOIDCAppReconciler) Reconcile(ctx context.Context, ztdClient *ma
 	}
 
 	secretData := map[string][]byte{"client-secret": []byte(resp.ClientSecret)}
-	secret, err := wr.Builder.BuildSecret(builder.SecretOpts{Immutable: true, Zitadel: nil, Key: key, Data: secretData}, wr.OIDCApp)
+	secret, err := wr.Builder.BuildSecret(builder.SecretOpts{Immutable: false, Zitadel: nil, Key: key, Data: secretData}, wr.OIDCApp)
 	if err != nil {
 		return fmt.Errorf("error building Secret: %v", err)
 	}