diff --git a/server/mdm/android/service/profiles.go b/server/mdm/android/service/profiles.go
index da84f3bc67..28c5b53b0d 100644
--- a/server/mdm/android/service/profiles.go
+++ b/server/mdm/android/service/profiles.go
@@ -38,6 +38,15 @@ func ReconcileProfiles(ctx context.Context, ds fleet.Datastore, logger kitlog.Lo
 	}
 
 	client := newAMAPIClient(ctx, logger, licenseKey)
+	authSecret, err := getClientAuthenticationSecret(ctx, ds)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "getting Android client authentication secret for profile reconciler")
+	}
+	err = client.SetAuthenticationSecret(authSecret)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "setting Android client authentication secret for profile reconciler")
+	}
+
 	reconciler := &profileReconciler{
 		DS:         ds,
 		Enterprise: enterprise,
@@ -54,6 +63,17 @@ type profileReconciler struct {
 	Client     androidmgmt.Client
 }
 
+func getClientAuthenticationSecret(ctx context.Context, ds fleet.Datastore) (string, error) {
+	assets, err := ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{fleet.MDMAssetAndroidFleetServerSecret}, nil)
+	switch {
+	case fleet.IsNotFound(err):
+		return "", nil
+	case err != nil:
+		return "", ctxerr.Wrap(ctx, err, "getting Android authentication secret")
+	}
+	return string(assets[fleet.MDMAssetAndroidFleetServerSecret].Value), nil
+}
+
 func (r *profileReconciler) ReconcileProfiles(ctx context.Context) error {
 	// get the list of hosts that need to have their profiles applied
 	hostsApplicableProfiles, hostsProfsToRemove, err := r.DS.ListMDMAndroidProfilesToSend(ctx)