diff --git a/ix-dev/community/opencloud/app.yaml b/ix-dev/community/opencloud/app.yaml
index 5dcd7ff9ea..c8911b4780 100644
--- a/ix-dev/community/opencloud/app.yaml
+++ b/ix-dev/community/opencloud/app.yaml
@@ -37,4 +37,4 @@ sources:
 - https://hub.docker.com/r/opencloudeu/opencloud-rolling
 title: OpenCloud
 train: community
-version: 1.0.22
+version: 1.0.23
diff --git a/ix-dev/community/opencloud/app_migrations.yaml b/ix-dev/community/opencloud/app_migrations.yaml
index 566fc14766..aa7a8cd4a9 100644
--- a/ix-dev/community/opencloud/app_migrations.yaml
+++ b/ix-dev/community/opencloud/app_migrations.yaml
@@ -13,4 +13,4 @@ migrations:
   from:
     max_version: 1.0.20
   target:
-    min_version: 1.0.22
+    min_version: 1.0.21
diff --git a/ix-dev/community/opencloud/migrations/fix_csp b/ix-dev/community/opencloud/migrations/fix_csp
index d612342bdf..2fa916b4e1 100755
--- a/ix-dev/community/opencloud/migrations/fix_csp
+++ b/ix-dev/community/opencloud/migrations/fix_csp
@@ -7,14 +7,14 @@ import yaml
 
 def migrate(values):
     new_csp = []
-    for x in values["opencloud"]["additional_csp"]:
+    for x in values["opencloud"].get("additional_csp", []):
         new_item = {"directive": x["directive"], "items": []}
         for i in x["items"]:
             if isinstance(i, str):
                 new_item["items"].append({"value": i, "placeholder": ""})
             else:
                 new_item["items"].append(i)
-        new_csp.append(new_item)  # ← This line was missing!
+        new_csp.append(new_item)
     values["opencloud"]["additional_csp"] = new_csp
     return values
 
diff --git a/ix-dev/community/opencloud/questions.yaml b/ix-dev/community/opencloud/questions.yaml
index cdc1a010c3..5eb1f0143c 100644
--- a/ix-dev/community/opencloud/questions.yaml
+++ b/ix-dev/community/opencloud/questions.yaml
@@ -112,6 +112,15 @@ questions:
                   type: boolean
                   show_if: [["enabled", "=", true]]
                   default: false
+              - variable: jwt_secret
+                label: JWT Secret
+                description: The JWT secret for OnlyOffice authentication. It must match the secret configured in the OnlyOffice server.
+                schema:
+                  type: string
+                  show_if: [["enabled", "=", true], ["type", "=", "onlyoffice"]]
+                  default: ""
+                  private: true
+                  required: true
         - variable: extra_services
           label: Extra Services
           description: |