diff --git a/docker/logto-bootstrap.sh b/docker/logto-bootstrap.sh
index 304f590..116f5df 100644
--- a/docker/logto-bootstrap.sh
+++ b/docker/logto-bootstrap.sh
@@ -52,6 +52,13 @@ pgpass() { PGPASSWORD="${PG_PASSWORD:-cameleer_dev}"; export PGPASSWORD; }
 # Install jq + curl
 apk add --no-cache jq curl >/dev/null 2>&1
 
+# Read cached secrets from previous run
+if [ -f "$BOOTSTRAP_FILE" ]; then
+  CACHED_M2M_SECRET=$(jq -r '.m2mClientSecret // empty' "$BOOTSTRAP_FILE" 2>/dev/null)
+  CACHED_TRAD_SECRET=$(jq -r '.tradAppSecret // empty' "$BOOTSTRAP_FILE" 2>/dev/null)
+  log "Found cached bootstrap file"
+fi
+
 # ============================================================
 # PHASE 1: Wait for services
 # ============================================================
@@ -151,9 +158,7 @@ TRAD_ID=$(echo "$EXISTING_APPS" | jq -r ".[] | select(.name == \"$TRAD_APP_NAME\
 TRAD_SECRET=""
 if [ -n "$TRAD_ID" ]; then
   log "Traditional app exists: $TRAD_ID"
-  pgpass
-  TRAD_SECRET=$(psql -h "$PG_HOST" -U "$PG_USER" -d "$PG_DB_LOGTO" -t -A -c \
-    "SELECT secret FROM applications WHERE id = '$TRAD_ID' AND tenant_id = 'default';")
+  TRAD_SECRET="${CACHED_TRAD_SECRET:-}"
 else
   log "Creating Traditional Web app..."
   TRAD_RESPONSE=$(api_post "/api/applications" "{
@@ -189,9 +194,7 @@ M2M_ID=$(echo "$EXISTING_APPS" | jq -r ".[] | select(.name == \"$M2M_APP_NAME\"
 M2M_SECRET=""
 if [ -n "$M2M_ID" ]; then
   log "M2M app exists: $M2M_ID"
-  pgpass
-  M2M_SECRET=$(psql -h "$PG_HOST" -U "$PG_USER" -d "$PG_DB_LOGTO" -t -A -c \
-    "SELECT secret FROM applications WHERE id = '$M2M_ID' AND tenant_id = 'default';")
+  M2M_SECRET="${CACHED_M2M_SECRET:-}"
 else
   log "Creating M2M app..."
   M2M_RESPONSE=$(api_post "/api/applications" "{
@@ -422,13 +425,16 @@ cat > "$BOOTSTRAP_FILE" <<EOF
   "m2mClientId": "$M2M_ID",
   "m2mClientSecret": "$M2M_SECRET",
   "tradAppId": "$TRAD_ID",
+  "tradAppSecret": "$TRAD_SECRET",
   "apiResourceIndicator": "$API_RESOURCE_INDICATOR",
   "organizationId": "$ORG_ID",
   "tenantName": "$TENANT_NAME",
   "tenantSlug": "$TENANT_SLUG",
   "bootstrapToken": "$BOOTSTRAP_TOKEN",
   "platformAdminUser": "$SAAS_ADMIN_USER",
-  "tenantAdminUser": "$TENANT_ADMIN_USER"
+  "tenantAdminUser": "$TENANT_ADMIN_USER",
+  "oidcIssuerUri": "${LOGTO_ENDPOINT}/oidc",
+  "oidcAudience": "$API_RESOURCE_INDICATOR"
 }
 EOF