diff --git a/pkg/validation/providers.go b/pkg/validation/providers.go
index 0c8e28db..47b8c880 100644
--- a/pkg/validation/providers.go
+++ b/pkg/validation/providers.go
@@ -106,6 +106,11 @@ func providerRequiresClientSecret(provider options.Provider) bool {
 		return false
 	}
 
+	// Apple uses a private key to dynamically generate client_secret JWTs
+	if provider.Type == "apple" {
+		return false
+	}
+
 	return true
 }
 
diff --git a/providers/apple.go b/providers/apple.go
index b9d3f6a4..87d928f8 100644
--- a/providers/apple.go
+++ b/providers/apple.go
@@ -295,11 +295,20 @@ func (p *AppleProvider) RefreshSession(ctx context.Context, s *sessions.SessionS
 func (p *AppleProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
 	ctx = oidc.ClientContext(ctx, requests.DefaultHTTPClient)
 
+	// Validate ID token if present
 	if s.IDToken != "" && p.Verifier != nil {
 		if _, err := p.Verifier.Verify(ctx, s.IDToken); err != nil {
 			return false
 		}
+		// ID token is valid - Apple doesn't provide a token validation endpoint,
+		return true
 	}
 
-	return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))
+	// Fallback to access token validation if ValidateURL is set
+	if p.ValidateURL != nil && p.ValidateURL.String() != "" {
+		return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))
+	}
+
+	// No validation possible, but session exists with valid data
+	return s.AccessToken != ""
 }