diff --git a/.drone.yml b/.drone.yml
index 9eb78f0..1d08a2e 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -4,7 +4,7 @@ name: check-fast
 
 services:
   - name: postgres
-    image: docker.io/library/postgres:18.1
+    image: docker.io/library/postgres:18.3
     environment:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
@@ -57,7 +57,7 @@ steps:
       - mix gettext.extract --check-up-to-date
 
   - name: wait_for_postgres
-    image: docker.io/library/postgres:18.1
+    image: docker.io/library/postgres:18.3
     commands:
       # Wait for postgres to become available
       - |
@@ -109,7 +109,7 @@ name: check-full
 
 services:
   - name: postgres
-    image: docker.io/library/postgres:18.1
+    image: docker.io/library/postgres:18.3
     environment:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
@@ -164,7 +164,7 @@ steps:
       - mix gettext.extract --check-up-to-date
 
   - name: wait_for_postgres
-    image: docker.io/library/postgres:18.1
+    image: docker.io/library/postgres:18.3
     commands:
       # Wait for postgres to become available
       - |
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 2c342f9..5ff00f1 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -33,7 +33,7 @@ services:
     restart: unless-stopped
 
   db-prod:
-    image: postgres:18.1-alpine
+    image: postgres:18.3-alpine
     container_name: mv-prod-db
     environment:
       POSTGRES_USER: postgres
diff --git a/docker-compose.yml b/docker-compose.yml
index 6f3861f..c3473b7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,7 +4,7 @@ networks:
 
 services:
   db:
-    image: postgres:18.1-alpine
+    image: postgres:18.3-alpine
     environment:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
diff --git a/lib/mv/config.ex b/lib/mv/config.ex
index 8b8c088..ec69b18 100644
--- a/lib/mv/config.ex
+++ b/lib/mv/config.ex
@@ -360,29 +360,13 @@ defmodule Mv.Config do
   end
 
   @doc """
-  Returns the OIDC client secret.
-  In production, uses the value from config :mv, :oidc (set by runtime.exs from OIDC_CLIENT_SECRET or OIDC_CLIENT_SECRET_FILE).
-  Otherwise ENV OIDC_CLIENT_SECRET, then Settings.
+  Returns the OIDC client secret. ENV first, then Settings.
   """
   @spec oidc_client_secret() :: String.t() | nil
   def oidc_client_secret do
-    case Application.get_env(:mv, :oidc) do
-      oidc when is_list(oidc) -> oidc_client_secret_from_config(Keyword.get(oidc, :client_secret))
-      _ -> env_or_setting("OIDC_CLIENT_SECRET", :oidc_client_secret)
-    end
+    env_or_setting("OIDC_CLIENT_SECRET", :oidc_client_secret)
   end
 
-  defp oidc_client_secret_from_config(nil),
-    do: env_or_setting("OIDC_CLIENT_SECRET", :oidc_client_secret)
-
-  defp oidc_client_secret_from_config(secret) when is_binary(secret) do
-    s = String.trim(secret)
-    if s != "", do: s, else: env_or_setting("OIDC_CLIENT_SECRET", :oidc_client_secret)
-  end
-
-  defp oidc_client_secret_from_config(_),
-    do: env_or_setting("OIDC_CLIENT_SECRET", :oidc_client_secret)
-
   @doc """
   Returns the OIDC admin group name (for role sync). ENV first, then Settings.
   """
@@ -442,10 +426,7 @@ defmodule Mv.Config do
   def oidc_client_id_env_set?, do: env_set?("OIDC_CLIENT_ID")
   def oidc_base_url_env_set?, do: env_set?("OIDC_BASE_URL")
   def oidc_redirect_uri_env_set?, do: env_set?("OIDC_REDIRECT_URI")
-
-  def oidc_client_secret_env_set?,
-    do: env_set?("OIDC_CLIENT_SECRET") or env_set?("OIDC_CLIENT_SECRET_FILE")
-
+  def oidc_client_secret_env_set?, do: env_set?("OIDC_CLIENT_SECRET")
   def oidc_admin_group_name_env_set?, do: env_set?("OIDC_ADMIN_GROUP_NAME")
   def oidc_groups_claim_env_set?, do: env_set?("OIDC_GROUPS_CLAIM")
   def oidc_only_env_set?, do: env_set?("OIDC_ONLY")