diff --git a/lib/secrets/secrets.go b/lib/secrets/secrets.go
index 9f49936..5cd7665 100644
--- a/lib/secrets/secrets.go
+++ b/lib/secrets/secrets.go
@@ -8,23 +8,24 @@ import (
 )
 
 type SiteSecret struct {
-	DevAdminToken      string `json:"dev-admin-token"` // likely to be removed
-	DevClientSecret    string `json:"dev-client-secret"`
-	DevDBPassword      string `json:"dev-db-password"`
-	DevLicense         string `json:"dev-license"`
-	DevUserToken       string `json:"dev-user-token"` // likely to be removed
-	DevChronicleApiKey string `json:"dev-chronicle-api-key"`
-	HomeAuthMap        string `json:"home-auth-map"`
-	KeycloakDBUser     string `json:"keycloak-db-user"`
-	KeycloakDBPassword string `json:"keycloak-db-password"`
-	PkgDBPassword      string `json:"pkg-db-password"`
-	PkgLicense         string `json:"pkg-license"`
-	PkgSecretKey       string `json:"pkg-secret-key"`
-	PubClientSecret    string `json:"pub-client-secret"`
-	PubDBPassword      string `json:"pub-db-password"`
-	PubLicense         string `json:"pub-license"`
-	PubSecretKey       string `json:"pub-secret-key"`
-	PubChronicleApiKey string `json:"pub-chronicle-api-key"`
+	DevAdminToken       string `json:"dev-admin-token"` // likely to be removed
+	DevClientSecret     string `json:"dev-client-secret"`
+	DevDBPassword       string `json:"dev-db-password"`
+	DevLicense          string `json:"dev-license"`
+	DevUserToken        string `json:"dev-user-token"` // likely to be removed
+	DevChronicleApiKey  string `json:"dev-chronicle-api-key"`
+	HomeAuthMap         string `json:"home-auth-map"`
+	KeycloakDBUser      string `json:"keycloak-db-user"`
+	KeycloakDBPassword  string `json:"keycloak-db-password"`
+	PkgDBPassword       string `json:"pkg-db-password"`
+	PkgLicense          string `json:"pkg-license"`
+	PkgSecretKey        string `json:"pkg-secret-key"`
+	PpmOidcClientSecret string `json:"ppm-oidc-client-secret"`
+	PubClientSecret     string `json:"pub-client-secret"`
+	PubDBPassword       string `json:"pub-db-password"`
+	PubLicense          string `json:"pub-license"`
+	PubSecretKey        string `json:"pub-secret-key"`
+	PubChronicleApiKey  string `json:"pub-chronicle-api-key"`
 }
 
 func NewSiteSecret(siteName string) SiteSecret {
diff --git a/python-pulumi/src/ptd/secrecy.py b/python-pulumi/src/ptd/secrecy.py
index 48721a3..31182ac 100644
--- a/python-pulumi/src/ptd/secrecy.py
+++ b/python-pulumi/src/ptd/secrecy.py
@@ -112,6 +112,7 @@ class AzureWorkloadSecret(typing.TypedDict):
         "pkg-db-password": str,
         "pkg-license": str,
         "pkg-secret-key": str,
+        "ppm-oidc-client-secret": str,
         "pub-client-secret": str,
         "pub-db-password": str,
         "pub-license": str,