diff --git a/cmd/server/flags.go b/cmd/server/flags.go
index 454936a08..c27729b4b 100644
--- a/cmd/server/flags.go
+++ b/cmd/server/flags.go
@@ -104,10 +104,11 @@ var flags = []cli.Flag{
 		Value:   ":9000",
 	},
 	&cli.StringFlag{
-		EnvVars: []string{"WOODPECKER_GRPC_SECRET"},
-		Name:    "grpc-secret",
-		Usage:   "grpc jwt secret",
-		Value:   "secret",
+		EnvVars:  []string{"WOODPECKER_GRPC_SECRET"},
+		Name:     "grpc-secret",
+		Usage:    "grpc jwt secret",
+		Value:    "secret",
+		FilePath: os.Getenv("WOODPECKER_GRPC_SECRET_FILE"),
 	},
 	&cli.StringFlag{
 		EnvVars: []string{"WOODPECKER_METRICS_SERVER_ADDR"},
diff --git a/docs/docs/30-administration/10-server-config.md b/docs/docs/30-administration/10-server-config.md
index 1505d1406..f49ff7e47 100644
--- a/docs/docs/30-administration/10-server-config.md
+++ b/docs/docs/30-administration/10-server-config.md
@@ -270,6 +270,11 @@ Configures the gRPC listener port.
 
 Configures the gRPC JWT secret.
 
+### `WOODPECKER_GRPC_SECRET_FILE`
+> Default: empty
+
+Read the value for `WOODPECKER_GRPC_SECRET` from the specified filepath.
+
 ### `WOODPECKER_METRICS_SERVER_ADDR`
 > Default: empty