diff --git a/internal/auth/oidc/repository_auth_method_update.go b/internal/auth/oidc/repository_auth_method_update.go
index 4a5dc8e1e..292da6b14 100644
--- a/internal/auth/oidc/repository_auth_method_update.go
+++ b/internal/auth/oidc/repository_auth_method_update.go
@@ -169,6 +169,15 @@ func (r *Repository) UpdateAuthMethod(ctx context.Context, am *AuthMethod, versi
 		return origAm, db.NoRowsAffected, nil
 	}
 
+	// ClientSecret is a bit odd, because it uses the Struct wrapping, we need
+	// to add the encrypted fields to the dbMask or nullFields
+	if strutil.StrListContains(filteredDbMask, "ClientSecret") {
+		filteredDbMask = append(filteredDbMask, "CtClientSecret", "ClientSecretHmac")
+	}
+	if strutil.StrListContains(filteredNullFields, "ClientSecret") {
+		filteredNullFields = append(filteredNullFields, "CtClientSecret", "ClientSecretHmac")
+	}
+
 	databaseWrapper, err := r.kms.GetWrapper(ctx, origAm.ScopeId, kms.KeyPurposeDatabase)
 	if err != nil {
 		return nil, db.NoRowsAffected, errors.Wrap(err, op, errors.WithMsg("unable to get database wrapper"))
diff --git a/internal/auth/oidc/repository_auth_method_update_test.go b/internal/auth/oidc/repository_auth_method_update_test.go
index bede52aea..06a56e289 100644
--- a/internal/auth/oidc/repository_auth_method_update_test.go
+++ b/internal/auth/oidc/repository_auth_method_update_test.go
@@ -76,15 +76,19 @@ func Test_UpdateAuthMethod(t *testing.T) {
 				am.Name = "alice's restaurant"
 				am.Description = "the best place to eat"
 				am.AudClaims = []string{"www.alice.com", "www.alice.com/admin"}
+				am.ClientSecret = "This is a new secret"
 				return &am
 			},
-			fieldMasks: []string{"Name", "Description", "AudClaims"},
+			fieldMasks: []string{"Name", "Description", "AudClaims", "ClientSecret"},
 			version:    1,
 			want: func(orig, updateWith *AuthMethod) *AuthMethod {
 				am := orig.Clone()
 				am.Name = updateWith.Name
 				am.Description = updateWith.Description
 				am.AudClaims = updateWith.AudClaims
+				am.ClientSecret = updateWith.ClientSecret
+				am.CtClientSecret = updateWith.CtClientSecret
+				am.ClientSecretHmac = updateWith.ClientSecretHmac
 				return am
 			},
 		},