diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -201,7 +201,15 @@
 {{- $_ := set $values "key" (printf "${GITEA_OAUTH_KEY_%d}" $idx) -}}
 {{- end -}}
 
-{{- if not (hasKey $values "secret") -}}
+{{- if hasKey $values "secretFile" -}}
+{{- if or (hasKey $values "secret") (hasKey $values "existingSecret") -}}
+{{- fail "OAuth secretFile conflicts with secret or existingSecret" -}}
+{{- end -}}
+{{- if ne $values.secretFile "/run/forgejo-oidc/CLIENT_SECRET" -}}
+{{- fail "OAuth secretFile requires the admitted mount path" -}}
+{{- end -}}
+{{- end -}}
+{{- if and (not (hasKey $values "secret")) (not (hasKey $values "secretFile")) -}}
 {{- $_ := set $values "secret" (printf "${GITEA_OAUTH_SECRET_%d}" $idx) -}}
 {{- end -}}
 
@@ -471,3 +479,28 @@
 {{- define "gitea.metrics-secret-name" -}}
 {{ default (printf "%s-metrics-secret" (include "gitea.fullname" .)) }}
 {{- end -}}
+
+{{/* Bounded first-case source continuation; no Secret value or alias key. */}}
+{{- define "gitea.oauth_private_validate" -}}
+{{- $private := 0 -}}
+{{- range $idx, $value := .Values.gitea.oauth -}}
+{{- if hasKey $value "secretFile" -}}
+{{- $private = add1 $private -}}
+{{- range $.Values.deployment.env -}}
+{{- if eq .name (printf "GITEA_OAUTH_SECRET_%d" $idx) -}}
+{{- fail "OAuth secretFile conflicts with indexed secret environment" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if gt $private 1 -}}{{- fail "Only one private OAuth mount is supported" -}}{{- end -}}
+{{- if gt $private 0 -}}
+{{- if ne (int .Values.podSecurityContext.fsGroup) 1000 -}}{{- fail "Private OAuth mount requires fsGroup 1000" -}}{{- end -}}
+{{- range .Values.extraVolumes -}}
+{{- if eq .name "oauth-private-client" -}}{{- fail "Private OAuth volume conflict" -}}{{- end -}}
+{{- end -}}
+{{- range concat .Values.extraVolumeMounts .Values.extraInitVolumeMounts .Values.extraContainerVolumeMounts -}}
+{{- if or (eq .name "oauth-private-client") (hasPrefix "/run/forgejo-oidc" .mountPath) -}}{{- fail "Private OAuth mount conflict" -}}{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
diff --git a/templates/gitea/deployment.yaml b/templates/gitea/deployment.yaml
--- a/templates/gitea/deployment.yaml
+++ b/templates/gitea/deployment.yaml
@@ -1,3 +1,4 @@
+{{- include "gitea.oauth_private_validate" . -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -260,6 +261,14 @@
             {{- toYaml .Values.deployment.env | nindent 12 }}
             {{- end }}
           volumeMounts:
+            {{- range .Values.gitea.oauth }}
+            {{- if hasKey . "secretFile" }}
+            - name: oauth-private-client
+              mountPath: /run/forgejo-oidc/CLIENT_SECRET
+              subPath: CLIENT_SECRET
+              readOnly: true
+            {{- end }}
+            {{- end }}
             - name: init
               mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
             - name: temp
@@ -388,6 +397,17 @@
         {{- toYaml .Values.dnsConfig | nindent 8 }}
     {{- end }}
       volumes:
+        {{- range .Values.gitea.oauth }}
+        {{- if hasKey . "secretFile" }}
+        - name: oauth-private-client
+          secret:
+            secretName: forgejo-netkingdom-oidc-client
+            defaultMode: 288
+            items:
+              - key: CLIENT_SECRET
+                path: CLIENT_SECRET
+        {{- end }}
+        {{- end }}
         - name: init
           secret:
             secretName: {{ include "gitea.fullname" . }}-init