diff --git a/cluster/applications/open-webui/deployment.yaml b/cluster/applications/open-webui/deployment.yaml
index 241a59c..2978a5a 100644
--- a/cluster/applications/open-webui/deployment.yaml
+++ b/cluster/applications/open-webui/deployment.yaml
@@ -37,7 +37,7 @@ spec:
           valueFrom:
             secretKeyRef:
               name: body-wars-secret
-              key: vllm-api-key
+              key: webui-secret-key
               optional: false
         # Backend configuration for vLLM (OpenAI-compatible, NOT Ollama)
         # OLLAMA_BASE_URLS removed: astro-orbiter runs vLLM, not Ollama
diff --git a/cluster/applications/open-webui/externalsecret.yaml b/cluster/applications/open-webui/externalsecret.yaml
index 81260d1..93afbf5 100644
--- a/cluster/applications/open-webui/externalsecret.yaml
+++ b/cluster/applications/open-webui/externalsecret.yaml
@@ -18,9 +18,15 @@ spec:
       engineVersion: v2
       data:
         vllm-api-key: "{{ .vllm_api_key }}"
+        webui-secret-key: "{{ .webui_secret_key }}"
   data:
     # vLLM API key from 1Password (mk-labs vault, vllm item, api-key field)
     - secretKey: vllm_api_key
       remoteRef:
         key: vllm
         property: api-key
+    # WebUI JWT signing secret from 1Password (mk-labs vault, open-webui item, secret-key field)
+    - secretKey: webui_secret_key
+      remoteRef:
+        key: open-webui
+        property: secret-key