diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml
index 50c18b5..91cad1d 100644
--- a/apps/opencloud/opencloud-deployment.yaml
+++ b/apps/opencloud/opencloud-deployment.yaml
@@ -99,10 +99,10 @@ spec:
         - name: PROXY_TLS
           value: "false"
 
-        # Exclude broken search service, internal IDP and IDM (using external OpenLDAP for user storage and Pocket ID for auth)
-        # Also exclude auth-basic since we're using OIDC-only authentication
+        # Exclude broken search service, internal IDP, and auth-basic (OIDC-only auth via Pocket ID)
+        # IDM re-enabled: needed for auto-provisioning user storage when users log in via Pocket ID
         - name: OC_EXCLUDE_RUN_SERVICES
-          value: "search,idp,idm,auth-basic"
+          value: "search,idp,auth-basic"
 
         # Data paths
         - name: OPENCLOUD_BASE_DATA_PATH
@@ -180,11 +180,10 @@ spec:
         - name: PROXY_ENABLE_BASIC_AUTH
           value: "false"
         
-        # Role assignment — reads the opencloud_role custom claim set on Pocket ID groups
+        # Role assignment — default gives all auto-provisioned OIDC users the standard user role
+        # (oidc driver required opencloud_role claim from Pocket ID which wasn't sent)
         - name: PROXY_ROLE_ASSIGNMENT_DRIVER
-          value: "oidc"
-        - name: PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM
-          value: "opencloud_role"
+          value: "default"
 
         # User auto-provisioning
         - name: PROXY_AUTOPROVISION_ACCOUNTS