diff --git a/CHANGELOG.md b/CHANGELOG.md
index 88ac5a5cf..432303eda 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,10 @@ and this project adheres to
 
 - ⚡️(backend) hash application secrets with SHA-256
 
+### Fixed
+
+- 🔒️(backend) prevent editing client id and secret in Django admin
+
 ## [1.34.0] - 2026-10-07
 
 ### Added
diff --git a/src/backend/core/admin.py b/src/backend/core/admin.py
index b5eb0d4ca..30138e85e 100644
--- a/src/backend/core/admin.py
+++ b/src/backend/core/admin.py
@@ -483,6 +483,11 @@ class ApplicationAdminForm(forms.ModelForm):
         if self.instance.pk and self.instance.scopes:
             self.fields["scopes"].initial = self.instance.scopes
 
+        # On creation: display generated credentials without allowing edits
+        for name in ("client_id", "client_secret"):
+            if name in self.fields:
+                self.fields[name].widget.attrs["readonly"] = True
+
 
 @admin.register(models.Application)
 class ApplicationAdmin(admin.ModelAdmin):