diff --git a/Directory.Build.props b/Directory.Build.props
index 66ead6dab..15e64a792 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -2,7 +2,7 @@
   <PropertyGroup>
     <!--This should be passed from the VSTS build-->
     <!-- This needs to be greater than or equal to the validation baseline version -->
-    <MicrosoftIdentityWebVersion Condition="'$(MicrosoftIdentityWebVersion)' == ''">3.13.2</MicrosoftIdentityWebVersion>
+    <MicrosoftIdentityWebVersion Condition="'$(MicrosoftIdentityWebVersion)' == ''">3.14.1</MicrosoftIdentityWebVersion>
     <!--This will generate AssemblyVersion, AssemblyFileVersion and AssemblyInformationVersion-->
     <Version>$(MicrosoftIdentityWebVersion)</Version>
 
diff --git a/changelog.md b/changelog.md
index 68bf3ca0a..ef18e35e9 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,3 +1,8 @@
+3.14.1
+=======
+##  Bug fix
+- Support client secrets with agent user identities. See [#3470](https://github.com/AzureAD/microsoft-identity-web/issues/3470) for details.
+
 3.14.0
 =======
 ## New features
diff --git a/src/Microsoft.Identity.Web.AgentIdentities/AgentUserIdentityMsalAddIn.cs b/src/Microsoft.Identity.Web.AgentIdentities/AgentUserIdentityMsalAddIn.cs
index f8bc1f935..75ed9c5ed 100644
--- a/src/Microsoft.Identity.Web.AgentIdentities/AgentUserIdentityMsalAddIn.cs
+++ b/src/Microsoft.Identity.Web.AgentIdentities/AgentUserIdentityMsalAddIn.cs
@@ -70,8 +70,7 @@ internal static Task OnBeforeUserFicForAgentUserIdentityAsync(
                         request.BodyParameters["grant_type"] = "user_fic";
                         request.BodyParameters.Remove("password");
 
-                        if (request.BodyParameters.TryGetValue("client_secret", out var secret)
-                                && secret.Equals("default", StringComparison.OrdinalIgnoreCase))
+                        if (request.BodyParameters.TryGetValue("client_secret", out var secret))
                         {
                             request.BodyParameters.Remove("client_secret");
                         }
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs
index 8ada50622..2f371921e 100644
--- a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs
+++ b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs
@@ -869,7 +869,12 @@ public async Task RemoveAccountAsync(
         private bool IsInvalidClientCertificateOrSignedAssertionError(MsalServiceException exMsal)
         {
             return !_retryClientCertificate &&
-                string.Equals(exMsal.ErrorCode, Constants.InvalidClient, StringComparison.OrdinalIgnoreCase);
+                string.Equals(exMsal.ErrorCode, Constants.InvalidClient, StringComparison.OrdinalIgnoreCase) &&
+                !exMsal.ResponseBody.Contains("AADSTS7000215" // No retry when wrong client secret.
+#if NET6_0_OR_GREATER
+                , StringComparison.OrdinalIgnoreCase
+#endif
+                );
         }