diff --git a/hscontrol/config.go b/hscontrol/config.go
index 0e83a1c..71fbfb0 100644
--- a/hscontrol/config.go
+++ b/hscontrol/config.go
@@ -573,7 +573,7 @@ func GetHeadscaleConfig() (*Config, error) {
 		if err != nil {
 			return nil, err
 		}
-		oidcClientSecret = string(secretBytes)
+		oidcClientSecret = strings.TrimSpace(string(secretBytes))
 	}
 
 	return &Config{