diff --git a/apps/vikunja/README.md b/apps/vikunja/README.md
index 574af33..8ba0b01 100644
--- a/apps/vikunja/README.md
+++ b/apps/vikunja/README.md
@@ -26,6 +26,7 @@ Both the app and Postgres pin to Hetzner location `fsn1` because their PVCs live
 - Pocket ID client `Vikunja` (id `cdfff4ee-28ba-4aab-9f47-7e41b4b6b847`), callback `https://vikunja.basicstack.de/auth/openid/basicstack`.
 - Pocket ID groups `vikunja_admins` and `vikunja_members`.
 - Vikunja does not map OIDC groups to the admin flag. Promote the first user post-login: `kubectl -n vikunja exec deploy/vikunja -- /app/vikunja/vikunja user set-admin --admin <username>`.
+- **PKCE must be OFF on the Pocket ID client.** Vikunja 2.x's OAuth redirect (`frontend/src/helpers/redirectToProvider.ts`) does not send `code_challenge`, and the Go backend does not implement PKCE either. With `pkceEnabled: true` on Pocket ID the flow fails at `/authorize` with `invalid_request … 'code_challenge' parameter is missing`. Client is confidential (`isPublic: false`), so `client_secret` still authenticates the token exchange.
 
 ## Optional: SMTP