diff --git a/actions/create-workflow-token/action.yml b/actions/create-workflow-token/action.yml
index 9b44f3d63..b0a25a84d 100644
--- a/actions/create-workflow-token/action.yml
+++ b/actions/create-workflow-token/action.yml
@@ -1,8 +1,8 @@
 name: 'Create workflow token'
 description: 'Create an app token, with fallback to $\{{ github.token }}'
 inputs:
-  app-id:
-    description: 'The GitHub App ID'
+  client-id:
+    description: 'The GitHub App Client ID'
     required: false
   private-key:
     description: 'The GitHub App private key (PEM format)'
@@ -21,7 +21,7 @@ runs:
       continue-on-error: true
       uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
       with:
-        app-id: ${{ inputs.app-id }}
+        client-id: ${{ inputs.client-id }}
         private-key: ${{ inputs.private-key }}
     - name: Set output
       id: output
diff --git a/tf/deployment/modules/shared/github/secrets/secrets.tf b/tf/deployment/modules/shared/github/secrets/secrets.tf
index 23deb236e..4fbaadb1c 100644
--- a/tf/deployment/modules/shared/github/secrets/secrets.tf
+++ b/tf/deployment/modules/shared/github/secrets/secrets.tf
@@ -50,6 +50,7 @@ data "onepassword_item" "push_o_matic_app" {
 locals {
   push_o_matic_fields = {
     app_id          = [for field in data.onepassword_item.push_o_matic_app.section[0].field : field.value if field.label == "app_id"][0]
+    client_id       = [for field in data.onepassword_item.push_o_matic_app.section[0].field : field.value if field.label == "client_id"][0]
     installation_id = [for field in data.onepassword_item.push_o_matic_app.section[0].field : field.value if field.label == "installation_id"][0]
   }
 }
@@ -87,6 +88,12 @@ import {
   id = "PUSH_O_MATIC_APP_KEY"
 }
 
+resource "github_actions_organization_secret" "push_o_matic_app_client_id" {
+  secret_name     = "PUSH_O_MATIC_APP_CLIENT_ID"
+  plaintext_value = local.push_o_matic_fields.client_id
+  visibility      = "all"
+}
+
 resource "github_actions_organization_secret" "docker_hub_read_token" {
   secret_name     = "DOCKER_HUB_READ_TOKEN"
   plaintext_value = data.terraform_remote_state.docker_org_state.outputs.read_token