diff --git a/src/serve/auth.go b/src/serve/auth.go
index 9575c8b..2391211 100644
--- a/src/serve/auth.go
+++ b/src/serve/auth.go
@@ -173,7 +173,9 @@ func (h *authHandler) deviceStart(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	da, err := h.oauth2.DeviceAuth(r.Context())
+	da, err := h.oauth2.DeviceAuth(r.Context(),
+		oauth2.SetAuthURLParam("client_secret", h.cfg.ClientSecret),
+	)
 	if err != nil {
 		writeError(w, http.StatusBadGateway, "device authorization request failed: "+err.Error())
 		return