diff --git a/lib/Helper/Hash.php b/lib/Helper/Hash.php
index 40647063d..a4cb9d983 100644
--- a/lib/Helper/Hash.php
+++ b/lib/Helper/Hash.php
@@ -54,10 +54,10 @@ public static function getClientIdHash(string $clientId): string {
 	 * This is used to create a unique identifier for users.
 	 *
 	 * @param string $userId
+	 * @param string $salt
 	 * @return string
 	 */
-	public static function getUserIdHash(string $userId): string {
-		// TODO: add a session salt
-		return hash('md5', $userId);
+	public static function getUserIdHash(string $userId, string $salt): string {
+		return hash('md5', $userId . $salt);
 	}
 }
diff --git a/lib/Model/User/User.php b/lib/Model/User/User.php
index baa5634a0..6c477a532 100644
--- a/lib/Model/User/User.php
+++ b/lib/Model/User/User.php
@@ -11,7 +11,6 @@
 use OCA\Polls\Helper\Container;
 use OCA\Polls\Model\Settings\AppSettings;
 use OCA\Polls\Model\UserBase;
-use OCP\IConfig;
 use OCP\IUser;
 use OCP\IUserManager;
 
@@ -21,7 +20,6 @@ class User extends UserBase {
 	/** @var string */
 	public const PRINCIPAL_PREFIX = 'principals/users/';
 
-	private IConfig $config;
 	private IUser $user;
 
 	public function __construct(
@@ -38,7 +36,6 @@ public function __construct(
 	 * setUp
 	 */
 	private function setUp(): void {
-		$this->config = Container::queryClass(IConfig::class);
 		$this->user = Container::queryClass(IUserManager::class)->get($this->id);
 		// $this->appSettings = Container::queryClass(AppSettings::class);
 		$this->displayName = $this->user->getDisplayName();
diff --git a/lib/Model/UserBase.php b/lib/Model/UserBase.php
index 4cdb05af9..6c31ad026 100644
--- a/lib/Model/UserBase.php
+++ b/lib/Model/UserBase.php
@@ -24,6 +24,7 @@
 use OCA\Polls\Model\User\User;
 use OCA\Polls\UserSession;
 use OCP\Collaboration\Collaborators\ISearch;
+use OCP\IConfig;
 use OCP\IGroupManager;
 use OCP\IL10N;
 use OCP\Share\IShare;
@@ -72,6 +73,7 @@ class UserBase implements JsonSerializable {
 	protected IL10N $l10n;
 	protected UserSession $userSession;
 	protected AppSettings $appSettings;
+	protected IConfig $config;
 
 	public function __construct(
 		protected string $id,
@@ -86,6 +88,7 @@ public function __construct(
 		$this->groupManager = Container::queryClass(IGroupManager::class);
 		$this->userSession = Container::queryClass(UserSession::class);
 		$this->appSettings = Container::queryClass(AppSettings::class);
+		$this->config = Container::queryClass(IConfig::class);
 	}
 
 	public function getId(): string {
@@ -111,7 +114,10 @@ public function getPrincipalUri(): string {
 	 * hash the real userId to obfuscate the real userId
 	 */
 	public function getHashedUserId(): string {
-		return Hash::getUserIdHash($this->id);
+		$instanceId = $this->config->getSystemValue('instanceid');
+		$instanceSecret = $this->config->getSystemValue('secret');
+		$salt = hash('md5', $instanceId . $instanceSecret);
+		return Hash::getUserIdHash($this->id, $salt);
 	}
 
 	/**