diff --git a/cli/cli.go b/cli/cli.go
index bd988249..b0ba453c 100644
--- a/cli/cli.go
+++ b/cli/cli.go
@@ -498,13 +498,13 @@ func (r *Runner) defaultRouter() *router.RouterController {
 		router.Route(r.config.Streams.PubSubChannel, streamController) // nolint:errcheck
 	}
 
-	if r.config.Streams.Turbo && r.config.Streams.Secret != "" {
-		turboController := streams.NewTurboController(r.config.Streams.Secret, r.log)
+	if r.config.Streams.Turbo && r.config.Streams.GetTurboSecret() != "" {
+		turboController := streams.NewTurboController(r.config.Streams.GetTurboSecret(), r.log)
 		router.Route("Turbo::StreamsChannel", turboController) // nolint:errcheck
 	}
 
-	if r.config.Streams.CableReady && r.config.Streams.Secret != "" {
-		crController := streams.NewCableReadyController(r.config.Streams.Secret, r.log)
+	if r.config.Streams.CableReady && r.config.Streams.GetCableReadySecret() != "" {
+		crController := streams.NewCableReadyController(r.config.Streams.GetCableReadySecret(), r.log)
 		router.Route("CableReady::Stream", crController) // nolint:errcheck
 	}
 
diff --git a/cli/options.go b/cli/options.go
index 66ea85f6..69c3214b 100644
--- a/cli/options.go
+++ b/cli/options.go
@@ -197,11 +197,9 @@ Use shutdown_timeout instead.`)
 	if turboRailsKey != "" {
 		fmt.Println(`DEPRECATION WARNING: turbo_rails_key option is deprecated
 and will be removed in the next major release of anycable-go.
-Use streams_secret instead.`)
+Use turbo_streams_secret instead.`)
 
-		if c.Streams.Secret == "" {
-			c.Streams.TurboSecret = turboRailsKey
-		}
+		c.Streams.TurboSecret = turboRailsKey
 
 		c.Streams.Turbo = true
 	}
@@ -215,11 +213,9 @@ It has no effect anymore, use public streams instead.`)
 	if cableReadyKey != "" {
 		fmt.Println(`DEPRECATION WARNING: cable_ready_key option is deprecated
 and will be removed in the next major release of anycable-go.
-Use streams_secret instead.`)
+Use cable_ready_secret instead.`)
 
-		if c.Streams.Secret == "" {
-			c.Streams.CableReadySecret = cableReadyKey
-		}
+		c.Streams.CableReadySecret = cableReadyKey
 
 		c.Streams.CableReady = true
 	}
@@ -263,24 +259,15 @@ It has no effect anymore, use public streams instead.`)
 		c.RPC.Implementation = "none"
 	}
 
-	// Configure secrets
-	if c.Streams.Secret == "" {
-		c.Streams.Secret = c.Secret
-	}
-
-	if c.JWT.Secret == "" {
-		c.JWT.Secret = c.Secret
-	}
-
-	if c.HTTPBroadcast.Secret == "" {
-		c.HTTPBroadcast.Secret = c.Secret
-	}
+	configureSecrets(
+		c.Secret,
+		&c.Streams.Secret,
+		&c.JWT.Secret,
+		&c.HTTPBroadcast.Secret,
+		&c.RPC.Secret,
+	)
 
-	if c.RPC.Secret == "" {
-		c.RPC.Secret = c.Secret
-	}
-
-	// Configure public mode
+	// Configure public mode and other insecure features
 	if isPublic {
 		c.SkipAuth = true
 		c.Streams.Public = true
@@ -1231,3 +1218,15 @@ func parseTags(str string) map[string]string {
 
 	return res
 }
+
+func configureSecrets(source string, targets ...*string) {
+	for _, t := range targets {
+		if (*t) == "" {
+			(*t) = source
+		}
+
+		if (*t) == "none" {
+			(*t) = ""
+		}
+	}
+}
diff --git a/features/sse.testfile b/features/sse.testfile
index f56ba1c1..56f880f7 100644
--- a/features/sse.testfile
+++ b/features/sse.testfile
@@ -1,5 +1,5 @@
 launch :anycable,
-  "./dist/anycable-go --sse --public_streams --secret=qwerty --broadcast_adapter=http --presets=broker"
+  "./dist/anycable-go --sse --public_streams --secret=qwerty --broadcast_adapter=http --presets=broker --http_broadcast_secret=none"
 
 wait_tcp 8080
 
diff --git a/streams/config.go b/streams/config.go
index 12115f02..b0760b04 100644
--- a/streams/config.go
+++ b/streams/config.go
@@ -40,7 +40,7 @@ func (c Config) GetTurboSecret() string {
 	return c.Secret
 }
 
-func (c Config) GetCableReaDySecret() string {
+func (c Config) GetCableReadySecret() string {
 	if c.CableReadySecret != "" {
 		return c.CableReadySecret
 	}