diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c5bb76d8b..3e9811f0f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -122,14 +122,15 @@ jobs:
         run: |
           sudo apt -y install zip pandoc man sed
           reqs=$(mktemp)
-          cat > $reqs << EOF
+          cat > "$reqs" << EOF
           python=3.10.*
           pyinstaller
           cffi
           brotli-python
+          secretstorage
           EOF
-          sed '/^brotli.*/d' requirements.txt >> $reqs
-          mamba create -n build --file $reqs
+          sed -E '/^(brotli|secretstorage).*/d' requirements.txt >> "$reqs"
+          mamba create -n build --file "$reqs"
 
       - name: Prepare
         run: |
diff --git a/requirements.txt b/requirements.txt
index 112c30aeb..4d2310725 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,8 +1,9 @@
 mutagen
 pycryptodomex
 websockets
-brotli; platform_python_implementation=='CPython'
-brotlicffi; platform_python_implementation!='CPython'
+brotli; implementation_name=='cpython'
+brotlicffi; implementation_name!='cpython'
 certifi
 requests>=2.31.0,<3
-urllib3>=1.26.17,<3
\ No newline at end of file
+urllib3>=1.26.17,<3
+secretstorage; sys_platform=='linux' and (implementation_name!='pypy' or implementation_version>='7.3.10')
diff --git a/yt_dlp/__pyinstaller/hook-yt_dlp.py b/yt_dlp/__pyinstaller/hook-yt_dlp.py
index c7f2c0ceb..20f037d32 100644
--- a/yt_dlp/__pyinstaller/hook-yt_dlp.py
+++ b/yt_dlp/__pyinstaller/hook-yt_dlp.py
@@ -25,7 +25,7 @@ def get_hidden_imports():
     for module in ('websockets', 'requests', 'urllib3'):
         yield from collect_submodules(module)
     # These are auto-detected, but explicitly add them just in case
-    yield from ('mutagen', 'brotli', 'certifi')
+    yield from ('mutagen', 'brotli', 'certifi', 'secretstorage')
 
 
 hiddenimports = list(get_hidden_imports())