diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index cc40ac0a..878b5e08 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -3,15 +3,17 @@
   provider :developer if Rails.env.local? || ENV["DEVELOPER_LOGIN_ENABLED"] == "true"
   # https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps
   provider :github,
-    ENV["GITHUB_CLIENT_ID"],
-    ENV["GITHUB_CLIENT_SECRET"],
+    Rails.application.credentials.dig(:github, :client_id) || ENV["GITHUB_CLIENT_ID"],
+    Rails.application.credentials.dig(:github, :client_secret) || ENV["GITHUB_CLIENT_SECRET"],
     scope: "user:email"
   provider :google_oauth2,
-    ENV["GOOGLE_CLIENT_ID"],
-    ENV["GOOGLE_CLIENT_SECRET"],
+    Rails.application.credentials.dig(:google, :client_id) || ENV["GOOGLE_CLIENT_ID"],
+    Rails.application.credentials.dig(:google, :client_secret) || ENV["GOOGLE_CLIENT_SECRET"],
     prompt: "select_account"
   # https://www.openstreetmap.org/oauth2/applications
-  provider :osm_oauth2, ENV["OSM_CLIENT_ID"], ENV["OSM_CLIENT_SECRET"]
+  provider :osm_oauth2,
+    Rails.application.credentials.dig(:osm, :client_id) || ENV["OSM_CLIENT_ID"],
+    Rails.application.credentials.dig(:osm, :client_secret) || ENV["OSM_CLIENT_SECRET"]
 end
 
 OmniAuth.config.request_validation_phase = OmniAuth::AuthenticityTokenProtection.new(key: :_csrf_token)
diff --git a/spec/initializers/omniauth_spec.rb b/spec/initializers/omniauth_spec.rb
new file mode 100644
index 00000000..2351b1d1
--- /dev/null
+++ b/spec/initializers/omniauth_spec.rb
@@ -0,0 +1,120 @@
+require "rails_helper"
+
+RSpec.describe "OmniAuth credential resolution" do
+  describe "GitHub" do
+    context "when Rails credentials are configured" do
+      before do
+        allow(Rails.application.credentials).to receive(:dig).with(:github, :client_id).and_return("cred_github_id")
+        allow(Rails.application.credentials).to receive(:dig).with(:github, :client_secret).and_return("cred_github_secret")
+      end
+
+      it "prefers credentials over ENV for client_id" do
+        expect(Rails.application.credentials.dig(:github, :client_id) || ENV["GITHUB_CLIENT_ID"]).to eq("cred_github_id")
+      end
+
+      it "prefers credentials over ENV for client_secret" do
+        expect(Rails.application.credentials.dig(:github, :client_secret) || ENV["GITHUB_CLIENT_SECRET"]).to eq("cred_github_secret")
+      end
+    end
+
+    context "when Rails credentials are absent" do
+      before do
+        allow(Rails.application.credentials).to receive(:dig).with(:github, :client_id).and_return(nil)
+        allow(Rails.application.credentials).to receive(:dig).with(:github, :client_secret).and_return(nil)
+        ENV["GITHUB_CLIENT_ID"] = "env_github_id"
+        ENV["GITHUB_CLIENT_SECRET"] = "env_github_secret"
+      end
+
+      after do
+        ENV.delete("GITHUB_CLIENT_ID")
+        ENV.delete("GITHUB_CLIENT_SECRET")
+      end
+
+      it "falls back to ENV for client_id" do
+        expect(Rails.application.credentials.dig(:github, :client_id) || ENV["GITHUB_CLIENT_ID"]).to eq("env_github_id")
+      end
+
+      it "falls back to ENV for client_secret" do
+        expect(Rails.application.credentials.dig(:github, :client_secret) || ENV["GITHUB_CLIENT_SECRET"]).to eq("env_github_secret")
+      end
+    end
+  end
+
+  describe "Google" do
+    context "when Rails credentials are configured" do
+      before do
+        allow(Rails.application.credentials).to receive(:dig).with(:google, :client_id).and_return("cred_google_id")
+        allow(Rails.application.credentials).to receive(:dig).with(:google, :client_secret).and_return("cred_google_secret")
+      end
+
+      it "prefers credentials over ENV for client_id" do
+        expect(Rails.application.credentials.dig(:google, :client_id) || ENV["GOOGLE_CLIENT_ID"]).to eq("cred_google_id")
+      end
+
+      it "prefers credentials over ENV for client_secret" do
+        expect(Rails.application.credentials.dig(:google, :client_secret) || ENV["GOOGLE_CLIENT_SECRET"]).to eq("cred_google_secret")
+      end
+    end
+
+    context "when Rails credentials are absent" do
+      before do
+        allow(Rails.application.credentials).to receive(:dig).with(:google, :client_id).and_return(nil)
+        allow(Rails.application.credentials).to receive(:dig).with(:google, :client_secret).and_return(nil)
+        ENV["GOOGLE_CLIENT_ID"] = "env_google_id"
+        ENV["GOOGLE_CLIENT_SECRET"] = "env_google_secret"
+      end
+
+      after do
+        ENV.delete("GOOGLE_CLIENT_ID")
+        ENV.delete("GOOGLE_CLIENT_SECRET")
+      end
+
+      it "falls back to ENV for client_id" do
+        expect(Rails.application.credentials.dig(:google, :client_id) || ENV["GOOGLE_CLIENT_ID"]).to eq("env_google_id")
+      end
+
+      it "falls back to ENV for client_secret" do
+        expect(Rails.application.credentials.dig(:google, :client_secret) || ENV["GOOGLE_CLIENT_SECRET"]).to eq("env_google_secret")
+      end
+    end
+  end
+
+  describe "OpenStreetMap" do
+    context "when Rails credentials are configured" do
+      before do
+        allow(Rails.application.credentials).to receive(:dig).with(:osm, :client_id).and_return("cred_osm_id")
+        allow(Rails.application.credentials).to receive(:dig).with(:osm, :client_secret).and_return("cred_osm_secret")
+      end
+
+      it "prefers credentials over ENV for client_id" do
+        expect(Rails.application.credentials.dig(:osm, :client_id) || ENV["OSM_CLIENT_ID"]).to eq("cred_osm_id")
+      end
+
+      it "prefers credentials over ENV for client_secret" do
+        expect(Rails.application.credentials.dig(:osm, :client_secret) || ENV["OSM_CLIENT_SECRET"]).to eq("cred_osm_secret")
+      end
+    end
+
+    context "when Rails credentials are absent" do
+      before do
+        allow(Rails.application.credentials).to receive(:dig).with(:osm, :client_id).and_return(nil)
+        allow(Rails.application.credentials).to receive(:dig).with(:osm, :client_secret).and_return(nil)
+        ENV["OSM_CLIENT_ID"] = "env_osm_id"
+        ENV["OSM_CLIENT_SECRET"] = "env_osm_secret"
+      end
+
+      after do
+        ENV.delete("OSM_CLIENT_ID")
+        ENV.delete("OSM_CLIENT_SECRET")
+      end
+
+      it "falls back to ENV for client_id" do
+        expect(Rails.application.credentials.dig(:osm, :client_id) || ENV["OSM_CLIENT_ID"]).to eq("env_osm_id")
+      end
+
+      it "falls back to ENV for client_secret" do
+        expect(Rails.application.credentials.dig(:osm, :client_secret) || ENV["OSM_CLIENT_SECRET"]).to eq("env_osm_secret")
+      end
+    end
+  end
+end