diff --git a/.env.photoprism.example b/.env.photoprism.example
index e165254..41dd44c 100644
--- a/.env.photoprism.example
+++ b/.env.photoprism.example
@@ -51,14 +51,18 @@ PP_GID=1000
 
 # ── OIDC SSO (Authentik or equivalent) ───────────────────────────────────────
 # Leave blank to keep OIDC dormant. Fill in to enable the "Sign in with OIDC"
-# button on the login page; per plan, OIDC_REGISTER=true auto-creates
-# accounts at role `user`.
+# button on the login page; OIDC_REGISTER=true auto-creates accounts at role
+# `user` (override to `admin` to grant full access on first SSO login).
+#
+# The compose file reads these and maps them to PhotoPrism's actual env-var
+# names (PHOTOPRISM_OIDC_URI / _CLIENT / _SECRET / _PROVIDER) — see the
+# comment in docker-compose.photoprism.yml. The PhotoPrism callback URI is
+# auto-derived from PP_SITE_URL; do not set it manually.
 
 # OIDC_PROVIDER_NAME=Authentik
 # OIDC_ISSUER_URL=https://auth.example.com/application/o/photoprism/
 # OIDC_CLIENT_ID=...
 # OIDC_CLIENT_SECRET=...
-# OIDC_REDIRECT_URI=http://localhost:2342/api/v1/oidc/redirect
 # OIDC_SCOPES=openid profile email
 # OIDC_REGISTER=true
 # OIDC_ROLE=user
diff --git a/docker-compose.photoprism.yml b/docker-compose.photoprism.yml
index 7d87488..663dfe3 100644
--- a/docker-compose.photoprism.yml
+++ b/docker-compose.photoprism.yml
@@ -107,14 +107,22 @@ services:
       PHOTOPRISM_DISABLE_EXIFTOOL: "false"
       # OIDC — set in .env.photoprism when the IdP (Authentik) is wired up.
       # Empty values keep OIDC dormant; the username/password login still works.
-      PHOTOPRISM_OIDC_PROVIDER_NAME: ${OIDC_PROVIDER_NAME:-}
-      PHOTOPRISM_OIDC_ISSUER_URL: ${OIDC_ISSUER_URL:-}
-      PHOTOPRISM_OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
-      PHOTOPRISM_OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
-      PHOTOPRISM_OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-}
+      # PhotoPrism's CLI flags are --oidc-uri / --oidc-client / --oidc-secret
+      # / --oidc-provider, so the env-var names it actually reads are
+      # PHOTOPRISM_OIDC_URI / _CLIENT / _SECRET / _PROVIDER (NOT _ISSUER_URL
+      # / _CLIENT_ID / _CLIENT_SECRET / _PROVIDER_NAME — those are silently
+      # ignored, OIDC stays dormant, and `photoprism show config` reports
+      # blank oidc-uri / oidc-client). PHOTOPRISM_OIDC_REDIRECT is a bool
+      # (auto-redirect-from-/library/login), not a URL — PhotoPrism builds
+      # the callback from PHOTOPRISM_SITE_URL.
+      PHOTOPRISM_OIDC_PROVIDER: ${OIDC_PROVIDER_NAME:-${OIDC_PROVIDER:-}}
+      PHOTOPRISM_OIDC_URI: ${OIDC_ISSUER_URL:-${OIDC_URI:-}}
+      PHOTOPRISM_OIDC_CLIENT: ${OIDC_CLIENT_ID:-${OIDC_CLIENT:-}}
+      PHOTOPRISM_OIDC_SECRET: ${OIDC_CLIENT_SECRET:-${OIDC_SECRET:-}}
       PHOTOPRISM_OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email}
       PHOTOPRISM_OIDC_REGISTER: ${OIDC_REGISTER:-true}
       PHOTOPRISM_OIDC_ROLE: ${OIDC_ROLE:-user}
+      PHOTOPRISM_OIDC_REDIRECT: ${OIDC_REDIRECT:-false}
     working_dir: /photoprism
     volumes:
       # Existing photo library — mounted read-only in M0; flip to :rw in M2