diff --git a/pkg/service/handlers/bridge_test.go b/pkg/service/handlers/bridge_test.go
index b8a98b8..9cf4847 100644
--- a/pkg/service/handlers/bridge_test.go
+++ b/pkg/service/handlers/bridge_test.go
@@ -139,8 +139,8 @@ func TestSpotifyBridge(t *testing.T) {
 		t.Fatal("Could not find surrogate token in Marge sources")
 	}
 
-	if len(surrogate) != 32 {
-		t.Errorf("Expected surrogate to be 32 hex chars, got %s", surrogate)
+	if !strings.HasPrefix(surrogate, "bs-") || len(surrogate) != 35 {
+		t.Errorf("Expected surrogate to have 'bs-' prefix and be 35 chars, got %s", surrogate)
 	}
 
 	// Request refresh
diff --git a/pkg/service/spotify/service.go b/pkg/service/spotify/service.go
index d4caff3..d33809c 100644
--- a/pkg/service/spotify/service.go
+++ b/pkg/service/spotify/service.go
@@ -350,13 +350,15 @@ func (s *Service) GetAccountBySecret(secret string) (*Account, bool) {
 }
 
 func (s *Service) generateBoseSecret() string {
+	prefix := "bs-"
+
 	b := make([]byte, 16)
 	if _, err := rand.Read(b); err != nil {
 		// Fallback to timestamp-based if RNG fails
-		return fmt.Sprintf("bs-%d", time.Now().UnixNano())
+		return fmt.Sprintf("%s%d", prefix, time.Now().UnixNano())
 	}
 
-	return hex.EncodeToString(b)
+	return prefix + hex.EncodeToString(b)
 }
 
 // ResolveEntity resolves a Spotify URI to a name and image URL.