diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml
index 0dac85c..40e1c03 100644
--- a/apps/opencloud/opencloud-deployment.yaml
+++ b/apps/opencloud/opencloud-deployment.yaml
@@ -160,11 +160,7 @@ spec:
             secretKeyRef:
               name: opencloud-oidc-secret
               key: oidc-client-id
-        #- name: OC_OIDC_CLIENT_SECRET
-        #  valueFrom:
-        #    secretKeyRef:
-        #      name: opencloud-oidc-secret
-        #      key: oidc-client-secret
+        # No OC_OIDC_CLIENT_SECRET - OpenCloud web frontend is a public SPA using PKCE
         - name: OC_OIDC_CLIENT_SCOPES
           value: "openid profile email groups"
 
@@ -204,12 +200,13 @@ spec:
         - name: IDM_CREATE_DEMO_USERS
           value: "false"
 
-        # Web service OIDC configuration
+        # Web service OIDC configuration (Public Client with PKCE)
         - name: WEB_OIDC_CLIENT_ID
           valueFrom:
             secretKeyRef:
               name: opencloud-oidc-secret
               key: oidc-client-id
+        # No WEB_OIDC_CLIENT_SECRET - web frontend is a public SPA using PKCE
         - name: WEB_OIDC_AUTHORITY
           value: "https://auth.basicstack.de"
         - name: WEB_OIDC_METADATA_URL