diff --git a/server/service/apple_mdm.go b/server/service/apple_mdm.go
index 302bde1f79fa..4b2d211f51a0 100644
--- a/server/service/apple_mdm.go
+++ b/server/service/apple_mdm.go
@@ -513,7 +513,8 @@ func (svc *Service) NewMDMAppleDeclaration(ctx context.Context, teamID uint, r i
 		return nil, err
 	}
 
-	if err := svc.ds.ValidateEmbeddedSecrets(ctx, []string{string(data)}); err != nil {
+	dataWithSecrets, secretsUpdatedAt, err := svc.ds.ExpandEmbeddedSecretsAndUpdatedAt(ctx, string(data))
+	if err != nil {
 		return nil, fleet.NewInvalidArgumentError("profile", err.Error())
 	}