diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml
index 070410a..5198f48 100644
--- a/apps/opencloud/opencloud-deployment.yaml
+++ b/apps/opencloud/opencloud-deployment.yaml
@@ -91,9 +91,9 @@ spec:
         - name: PROXY_TLS
           value: "false"
 
-        # Exclude broken search service (GitHub issue #1740)
+        # Exclude broken search service + internal IDP (using Pocket ID)
         - name: OC_EXCLUDE_RUN_SERVICES
-          value: "search"
+          value: "idp,search"
 
         # Data paths
         - name: OPENCLOUD_BASE_DATA_PATH
@@ -151,10 +151,12 @@ spec:
             secretKeyRef:
               name: opencloud-oidc-secret
               key: oidc-client-secret
+        - name: OC_OIDC_CLIENT_SCOPES
+          value: "openid profile email groups offline_access"
         - name: PROXY_OIDC_REWRITE_WELLKNOWN
           value: "true"
         - name: PROXY_USER_OIDC_CLAIM
-          value: "preferred_username"
+          value: "email"
         - name: PROXY_USER_CS3_CLAIM
           value: "username"
         - name: PROXY_AUTOPROVISION_ACCOUNTS
@@ -163,6 +165,8 @@ spec:
           value: "oidc"
         - name: PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM
           value: "groups"
+        - name: IDP_DOMAIN
+          value: "auth.basicstack.de"
 
         # SMTP Configuration
         - name: NOTIFICATIONS_SMTP_HOST