diff --git a/backend/internal/controller/oidc_controller.go b/backend/internal/controller/oidc_controller.go
index dd0e1ecb..9a00bd8e 100644
--- a/backend/internal/controller/oidc_controller.go
+++ b/backend/internal/controller/oidc_controller.go
@@ -34,7 +34,6 @@ func NewOidcController(group *gin.RouterGroup, authMiddleware *middleware.AuthMi
 	group.DELETE("/oidc/clients/:id", authMiddleware.Add(), httpserver.Handle(oc.deleteClientHandler))
 
 	group.PUT("/oidc/clients/:id/allowed-user-groups", authMiddleware.Add(), httpserver.Handle(oc.updateAllowedUserGroupsHandler))
-	group.POST("/oidc/clients/:id/secret", authMiddleware.Add(), httpserver.Handle(oc.replaceClientSecretHandler))
 	group.GET("/oidc/clients/:id/secrets", authMiddleware.Add(), httpserver.Handle(oc.listClientSecretsHandler))
 	group.POST("/oidc/clients/:id/secrets", authMiddleware.Add(), httpserver.Handle(oc.createClientSecretHandler))
 	group.DELETE("/oidc/clients/:id/secrets/:secretId", authMiddleware.Add(), httpserver.Handle(oc.deleteClientSecretHandler))
@@ -258,32 +257,6 @@ func (oc *OidcController) refreshClientMetadataHandler(c *gin.Context) error {
 	return nil
 }
 
-// replaceClientSecretHandler godoc
-// @Summary Replace client secrets
-// @Description Set or generate a new secret for an OIDC client, removing all of its existing secrets. Deprecated: use POST /api/oidc/clients/{id}/secrets to add a secret without invalidating the existing ones.
-// @Tags OIDC
-// @Accept json
-// @Produce json
-// @Param id path string true "Client ID"
-// @Param payload body dto.OidcClientSecretCreateDto false "Client secret"
-// @Success 200 {object} object "{ \"secret\": \"string\" }"
-// @Deprecated true
-// @Router /api/oidc/clients/{id}/secret [post]
-func (oc *OidcController) replaceClientSecretHandler(c *gin.Context) error {
-	var input dto.OidcClientSecretCreateDto
-	if err := httpserver.BindOptionalJSON(c, &input); err != nil {
-		return err
-	}
-
-	_, secret, err := oc.oidcService.ReplaceClientSecrets(c.Request.Context(), c.Param("id"), input)
-	if err != nil {
-		return err
-	}
-
-	c.JSON(http.StatusOK, gin.H{"secret": secret})
-	return nil
-}
-
 // listClientSecretsHandler godoc
 // @Summary List client secrets
 // @Description List the secrets of an OIDC client, without disclosing their values
diff --git a/backend/internal/service/oidc_service.go b/backend/internal/service/oidc_service.go
index 8ea08703..9e52ae7a 100644
--- a/backend/internal/service/oidc_service.go
+++ b/backend/internal/service/oidc_service.go
@@ -333,16 +333,6 @@ func (s *OidcService) ListClientSecrets(ctx context.Context, clientID string) ([
 
 // CreateClientSecret adds a new secret to a client and returns both the stored record and the secret's value, which is not recoverable afterwards
 func (s *OidcService) CreateClientSecret(ctx context.Context, clientID string, input dto.OidcClientSecretCreateDto) (model.OidcClientSecret, string, error) {
-	return s.createClientSecretInternal(ctx, clientID, input, false)
-}
-
-// ReplaceClientSecrets removes every existing secret of a client and creates a new one
-// It backs the deprecated single-secret endpoint, whose documented behavior is that creating a secret invalidates the previous one
-func (s *OidcService) ReplaceClientSecrets(ctx context.Context, clientID string, input dto.OidcClientSecretCreateDto) (model.OidcClientSecret, string, error) {
-	return s.createClientSecretInternal(ctx, clientID, input, true)
-}
-
-func (s *OidcService) createClientSecretInternal(ctx context.Context, clientID string, input dto.OidcClientSecretCreateDto, replaceExisting bool) (model.OidcClientSecret, string, error) {
 	// An expiration date in the past would create a secret that can never be used
 	if input.ExpiresAt != nil && !input.ExpiresAt.ToTime().After(time.Now()) {
 		return model.OidcClientSecret{}, "", apperror.ValidationMessage("The expiration date of a client secret must be in the future")
@@ -362,9 +352,7 @@ func (s *OidcService) createClientSecretInternal(ctx context.Context, clientID s
 		return model.OidcClientSecret{}, "", apperror.ValidationMessage("Cannot create a secret for a public client")
 	}
 
-	if replaceExisting {
-		client.Credentials.Secrets = nil
-	} else if len(client.Credentials.Secrets) >= model.MaxOidcClientSecrets {
+	if len(client.Credentials.Secrets) >= model.MaxOidcClientSecrets {
 		return model.OidcClientSecret{}, "", apperror.ValidationMessage(fmt.Sprintf("A client cannot have more than %d secrets", model.MaxOidcClientSecrets))
 	}
 
diff --git a/backend/internal/service/oidc_service_test.go b/backend/internal/service/oidc_service_test.go
index be916ab4..ecbbfd01 100644
--- a/backend/internal/service/oidc_service_test.go
+++ b/backend/internal/service/oidc_service_test.go
@@ -755,14 +755,6 @@ func TestOidcService_CreateClientSecret_limit(t *testing.T) {
 
 	_, _, err = s.CreateClientSecret(t.Context(), client.ID, dto.OidcClientSecretCreateDto{})
 	require.Error(t, err)
-
-	// The deprecated endpoint replaces every existing secret with a single new one
-	_, _, err = s.ReplaceClientSecrets(t.Context(), client.ID, dto.OidcClientSecretCreateDto{})
-	require.NoError(t, err)
-
-	secrets, err := s.ListClientSecrets(t.Context(), client.ID)
-	require.NoError(t, err)
-	assert.Len(t, secrets, 1)
 }
 
 func TestOidcService_CreateClientSecret_preservesFederatedIdentities(t *testing.T) {