diff --git a/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go.tmpl b/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go.tmpl
index 9be047011..09f74c7cb 100644
--- a/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go.tmpl
+++ b/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go.tmpl
@@ -62,7 +62,7 @@ type OIDCClaims struct {
 type OIDCClient struct {
 	// SecretName contains the name of a namespace-local Secret object that provides the clientID and
 	// clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient
-	// struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc" with keys
+	// struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client" with keys
 	// "clientID" and "clientSecret".
 	SecretName string `json:"secretName"`
 }
diff --git a/deploy/supervisor/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml b/deploy/supervisor/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml
index 780fe6fed..bd239a6f1 100644
--- a/deploy/supervisor/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml
+++ b/deploy/supervisor/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml
@@ -86,7 +86,7 @@ spec:
                     description: SecretName contains the name of a namespace-local
                       Secret object that provides the clientID and clientSecret for
                       an OIDC client. If only the SecretName is specified in an OIDCClient
-                      struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc"
+                      struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client"
                       with keys "clientID" and "clientSecret".
                     type: string
                 required:
diff --git a/generated/1.17/README.adoc b/generated/1.17/README.adoc
index 0ccdd1df9..1303b2a42 100644
--- a/generated/1.17/README.adoc
+++ b/generated/1.17/README.adoc
@@ -442,7 +442,7 @@ OIDCClient contains information about an OIDC client (e.g., client ID and client
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the clientID and clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc" with keys "clientID" and "clientSecret".
+| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the clientID and clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client" with keys "clientID" and "clientSecret".
 |===
 
 
diff --git a/generated/1.17/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go b/generated/1.17/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go
index 9be047011..09f74c7cb 100644
--- a/generated/1.17/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go
+++ b/generated/1.17/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go
@@ -62,7 +62,7 @@ type OIDCClaims struct {
 type OIDCClient struct {
 	// SecretName contains the name of a namespace-local Secret object that provides the clientID and
 	// clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient
-	// struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc" with keys
+	// struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client" with keys
 	// "clientID" and "clientSecret".
 	SecretName string `json:"secretName"`
 }
diff --git a/generated/1.17/crds/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml b/generated/1.17/crds/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml
index 780fe6fed..bd239a6f1 100644
--- a/generated/1.17/crds/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml
+++ b/generated/1.17/crds/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml
@@ -86,7 +86,7 @@ spec:
                     description: SecretName contains the name of a namespace-local
                       Secret object that provides the clientID and clientSecret for
                       an OIDC client. If only the SecretName is specified in an OIDCClient
-                      struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc"
+                      struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client"
                       with keys "clientID" and "clientSecret".
                     type: string
                 required:
diff --git a/generated/1.18/README.adoc b/generated/1.18/README.adoc
index 97042b25d..7c3dda8f0 100644
--- a/generated/1.18/README.adoc
+++ b/generated/1.18/README.adoc
@@ -442,7 +442,7 @@ OIDCClient contains information about an OIDC client (e.g., client ID and client
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the clientID and clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc" with keys "clientID" and "clientSecret".
+| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the clientID and clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client" with keys "clientID" and "clientSecret".
 |===
 
 
diff --git a/generated/1.18/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go b/generated/1.18/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go
index 9be047011..09f74c7cb 100644
--- a/generated/1.18/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go
+++ b/generated/1.18/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go
@@ -62,7 +62,7 @@ type OIDCClaims struct {
 type OIDCClient struct {
 	// SecretName contains the name of a namespace-local Secret object that provides the clientID and
 	// clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient
-	// struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc" with keys
+	// struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client" with keys
 	// "clientID" and "clientSecret".
 	SecretName string `json:"secretName"`
 }
diff --git a/generated/1.18/crds/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml b/generated/1.18/crds/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml
index 780fe6fed..bd239a6f1 100644
--- a/generated/1.18/crds/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml
+++ b/generated/1.18/crds/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml
@@ -86,7 +86,7 @@ spec:
                     description: SecretName contains the name of a namespace-local
                       Secret object that provides the clientID and clientSecret for
                       an OIDC client. If only the SecretName is specified in an OIDCClient
-                      struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc"
+                      struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client"
                       with keys "clientID" and "clientSecret".
                     type: string
                 required:
diff --git a/generated/1.19/README.adoc b/generated/1.19/README.adoc
index edda33b88..d4d0c8b1a 100644
--- a/generated/1.19/README.adoc
+++ b/generated/1.19/README.adoc
@@ -442,7 +442,7 @@ OIDCClient contains information about an OIDC client (e.g., client ID and client
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the clientID and clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc" with keys "clientID" and "clientSecret".
+| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the clientID and clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client" with keys "clientID" and "clientSecret".
 |===
 
 
diff --git a/generated/1.19/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go b/generated/1.19/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go
index 9be047011..09f74c7cb 100644
--- a/generated/1.19/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go
+++ b/generated/1.19/apis/supervisor/idp/v1alpha1/types_upstreamoidcprovider.go
@@ -62,7 +62,7 @@ type OIDCClaims struct {
 type OIDCClient struct {
 	// SecretName contains the name of a namespace-local Secret object that provides the clientID and
 	// clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient
-	// struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc" with keys
+	// struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client" with keys
 	// "clientID" and "clientSecret".
 	SecretName string `json:"secretName"`
 }
diff --git a/generated/1.19/crds/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml b/generated/1.19/crds/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml
index 780fe6fed..bd239a6f1 100644
--- a/generated/1.19/crds/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml
+++ b/generated/1.19/crds/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml
@@ -86,7 +86,7 @@ spec:
                     description: SecretName contains the name of a namespace-local
                       Secret object that provides the clientID and clientSecret for
                       an OIDC client. If only the SecretName is specified in an OIDCClient
-                      struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc"
+                      struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client"
                       with keys "clientID" and "clientSecret".
                     type: string
                 required: