diff --git a/app/server/core/__tests__/config.test.ts b/app/server/core/__tests__/config.test.ts
index b471d79a..64e1b68b 100644
--- a/app/server/core/__tests__/config.test.ts
+++ b/app/server/core/__tests__/config.test.ts
@@ -94,6 +94,17 @@ describe("parseConfig", () => {
 		expect(config.appSecret).toBe(fileAppSecret);
 	});
 
+	test("reads APP_SECRET from APP_SECRET_FILE when APP_SECRET is empty", () => {
+		const config = parseConfig(
+			createEnv({
+				APP_SECRET: "",
+				APP_SECRET_FILE: appSecretFixturePath,
+			}),
+		);
+
+		expect(config.appSecret).toBe(fileAppSecret);
+	});
+
 	test("exits when APP_SECRET is missing", () => {
 		expectParseConfigToExit(
 			createEnv({
diff --git a/app/server/core/config.ts b/app/server/core/config.ts
index 14cb7d43..ef08b087 100644
--- a/app/server/core/config.ts
+++ b/app/server/core/config.ts
@@ -39,7 +39,7 @@ const envSchema = z
 		TRUSTED_ORIGINS: z.string().optional(),
 		TRUST_PROXY: z.string().default("false"),
 		DISABLE_RATE_LIMITING: z.string().default("false"),
-		APP_SECRET: z.string().min(32).max(256).optional(),
+		APP_SECRET: z.preprocess((value) => (value === "" ? undefined : value), z.string().min(32).max(256).optional()),
 		APP_SECRET_FILE: z.string().optional(),
 		BASE_URL: z.string(),
 		ENABLE_DEV_PANEL: z.string().default("false"),