diff --git a/etherpad/application.yaml b/etherpad/application.yaml
index b0681c3..5919410 100644
--- a/etherpad/application.yaml
+++ b/etherpad/application.yaml
@@ -42,6 +42,13 @@ spec:
             runAsUser: 5001
           ports:
             - containerPort: 9001
+          # SSO_ISSUER, ADMIN_SECRET, USER_SECRET, ADMIN_REDIRECT and
+          # USER_REDIRECT live in application-secrets; without this they sit in
+          # the Secret unused and Etherpad keeps logging that its embedded OIDC
+          # clients use placeholder secrets.
+          envFrom:
+            - secretRef:
+                name: application-secrets
           env:
             - name: MINIFY
               value: 'false'