diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fabbbb0c..9cc7fe2f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,8 @@ env:
   CARGO_TERM_COLOR: always
   CICD_INTERMEDIATES_DIR: "_cicd-intermediates"
   WUKONG_HONEYCOMB_API_KEY: ${{ secrets.WUKONG_HONEYCOMB_API_KEY }}
+  GOOGLE_CLIENT_ID: ${{ vars.GOOGLE_CLIENT_ID }}
+  GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
   CI: true
 
 jobs:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 272cc05f..c3799e7e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,6 +9,8 @@ env:
   CARGO_TERM_COLOR: always
   CICD_INTERMEDIATES_DIR: "_cicd-intermediates"
   WUKONG_HONEYCOMB_API_KEY: ${{ secrets.WUKONG_HONEYCOMB_API_KEY }}
+  GOOGLE_CLIENT_ID: ${{ vars.GOOGLE_CLIENT_ID }}
+  GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
 
 jobs:
   tag-name:
diff --git a/Cross.toml b/Cross.toml
index d3678270..8f87e47d 100644
--- a/Cross.toml
+++ b/Cross.toml
@@ -1,5 +1,11 @@
 [build.env]
-passthrough = ["WUKONG_HONEYCOMB_API_KEY", "OKTA_CLIENT_ID", "WUKONG_API_URL"]
+passthrough = [
+  "WUKONG_HONEYCOMB_API_KEY",
+  "OKTA_CLIENT_ID",
+  "WUKONG_API_URL",
+  "GOOGLE_CLIENT_ID",
+  "GOOGLE_CLIENT_SECRET",
+]
 
 [target.x86_64-unknown-linux-gnu]
 pre-build = [
diff --git a/cli/src/auth/google_cloud.rs b/cli/src/auth/google_cloud.rs
index fe8ec1cc..8bee0287 100644
--- a/cli/src/auth/google_cloud.rs
+++ b/cli/src/auth/google_cloud.rs
@@ -49,9 +49,38 @@ impl InstalledFlowDelegate for InstalledFlowBrowserDelegate {
     }
 }
 
-const GOOGLE_CLIENT_ID: &str =
-    "16448589901-ccrhj03hhg6adn9uv8vi2trnpmd62k6n.apps.googleusercontent.com";
-const GOOGLE_CLIENT_SECRET: &str = "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";
+// Injected at compile time from the GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET
+// secrets in CI (same pattern as WUKONG_HONEYCOMB_API_KEY in the telemetry crate).
+// Prod builds fail if the env vars are missing or empty; dev builds fall back
+// to empty (set both locally to test the Google login flow).
+#[cfg(feature = "prod")]
+const GOOGLE_CLIENT_ID: &str = env!("GOOGLE_CLIENT_ID");
+#[cfg(not(feature = "prod"))]
+const GOOGLE_CLIENT_ID: &str = match option_env!("GOOGLE_CLIENT_ID") {
+    Some(client_id) => client_id,
+    None => "",
+};
+#[cfg(feature = "prod")]
+const GOOGLE_CLIENT_SECRET: &str = env!("GOOGLE_CLIENT_SECRET");
+#[cfg(not(feature = "prod"))]
+const GOOGLE_CLIENT_SECRET: &str = match option_env!("GOOGLE_CLIENT_SECRET") {
+    Some(secret) => secret,
+    None => "",
+};
+
+// A missing GitHub Actions secret expands to an empty string rather than an
+// undefined env var, which env!() would happily accept. Guard against
+// releasing a binary with blank credentials.
+#[cfg(feature = "prod")]
+const _: () = assert!(
+    !GOOGLE_CLIENT_ID.is_empty(),
+    "GOOGLE_CLIENT_ID must not be empty in prod builds"
+);
+#[cfg(feature = "prod")]
+const _: () = assert!(
+    !GOOGLE_CLIENT_SECRET.is_empty(),
+    "GOOGLE_CLIENT_SECRET must not be empty in prod builds"
+);
 const TOKEN_URI: &str = "https://oauth2.googleapis.com/token";
 const AUTH_URI: &str = "https://accounts.google.com/o/oauth2/auth";
 const REDIRECT_URI: &str = "http://127.0.0.1/8855";