diff --git a/src/modules/Elsa.ExternalAuthentication.Secrets/Services/ElsaSecretBindingResolver.cs b/src/modules/Elsa.ExternalAuthentication.Secrets/Services/ElsaSecretBindingResolver.cs
index 20308a2ed..9bc8b4331 100644
--- a/src/modules/Elsa.ExternalAuthentication.Secrets/Services/ElsaSecretBindingResolver.cs
+++ b/src/modules/Elsa.ExternalAuthentication.Secrets/Services/ElsaSecretBindingResolver.cs
@@ -22,14 +22,13 @@ public sealed class ElsaSecretBindingResolver(
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(request.ConnectionId);
         ArgumentException.ThrowIfNullOrWhiteSpace(request.FieldName);
-        var fieldName = string.Concat(request.FieldName.Where(char.IsLetterOrDigit)).ToLowerInvariant();
-        if (fieldName.Length == 0)
+        if (!request.FieldName.Any(char.IsLetterOrDigit))
             throw new ArgumentException("The secret field name must contain a letter or digit.", nameof(request));
 
         // Stage every replacement under a new reference. The caller publishes
         // that reference with the connection CAS and removes it on CAS failure,
         // so a stale request can never rotate material used by the live binding.
-        var name = $"external-authentication-{request.ConnectionId.ToLowerInvariant()}-{fieldName}-{Guid.NewGuid():N}";
+        var name = $"external-authentication:{Guid.NewGuid():N}";
         var secret = await secretManager.CreateAsync(new()
         {
             Name = name,
diff --git a/test/unit/Elsa.ExternalAuthentication.UnitTests/Secrets/ElsaSecretBindingResolverTests.cs b/test/unit/Elsa.ExternalAuthentication.UnitTests/Secrets/ElsaSecretBindingResolverTests.cs
index de57b84b6..a72d6ca21 100644
--- a/test/unit/Elsa.ExternalAuthentication.UnitTests/Secrets/ElsaSecretBindingResolverTests.cs
+++ b/test/unit/Elsa.ExternalAuthentication.UnitTests/Secrets/ElsaSecretBindingResolverTests.cs
@@ -88,12 +88,15 @@ public class ElsaSecretBindingResolverTests
 
         using var value = new SensitiveString("super-secret");
         var binding = await resolver.StageAsync(new ManagedSecretBindingWriteRequest("connection-a", "clientSecret", value));
+        var replacementBinding = await resolver.StageAsync(new ManagedSecretBindingWriteRequest("connection-a", "clientSecret", value));
 
         Assert.Equal(SecretBindingOwnership.Managed, binding.Ownership);
         Assert.Equal(ElsaSecretBindingResolver.ResolverType, binding.ResolverType);
-        Assert.StartsWith("external-authentication-connection-a-clientsecret-", binding.Reference, StringComparison.Ordinal);
+        Assert.StartsWith("external-authentication:", binding.Reference, StringComparison.Ordinal);
+        Assert.True(Guid.TryParseExact(binding.Reference["external-authentication:".Length..], "N", out _));
+        Assert.NotEqual(binding.Reference, replacementBinding.Reference);
         Assert.DoesNotContain("super-secret", binding.Reference, StringComparison.Ordinal);
-        await manager.Received(1).CreateAsync(Arg.Is<CreateSecretRequest>(x => x.Value == "super-secret"), Arg.Any<CancellationToken>());
+        await manager.Received(2).CreateAsync(Arg.Is<CreateSecretRequest>(x => x.Value == "super-secret"), Arg.Any<CancellationToken>());
         await manager.DidNotReceive().RotateAsync(Arg.Any<string>(), Arg.Any<RotateSecretRequest>(), Arg.Any<CancellationToken>());
     }