diff --git a/manifest/overlays/production/argocd-cm-patch.yaml b/manifest/overlays/production/argocd-cm-patch.yaml
index 67d569a..a893163 100644
--- a/manifest/overlays/production/argocd-cm-patch.yaml
+++ b/manifest/overlays/production/argocd-cm-patch.yaml
@@ -96,10 +96,8 @@ data:
       - UpdateRequest
   url: https://argocd.olb42.com
   oidc.config: |
-    name: ZITADEL
-    issuer: https://zitadel.olb42.com
+    name: Zitadel
+    issuer: "https://zitadel.olb42.com"
     clientID: "370752543384470542"
     clientSecret: $oidc.zitadel.clientSecret
     requestedScopes: ["openid", "profile", "email", "groups"]
-    requestedIDTokenClaims: {"groups": {"essential": true}}
-    enablePKCEAuthentication: true
diff --git a/manifest/overlays/production/argocd-rbac-cm-patch.yaml b/manifest/overlays/production/argocd-rbac-cm-patch.yaml
index 173888a..b953bbc 100644
--- a/manifest/overlays/production/argocd-rbac-cm-patch.yaml
+++ b/manifest/overlays/production/argocd-rbac-cm-patch.yaml
@@ -7,8 +7,9 @@ data:
   policy.csv: |
     p, role:app-manager, applications, *, */*, allow
     p, role:app-viewer, applications, get, */*, allow
-    g, nick@olb42.com, role:admin
+    g, argocd_administrators, role:admin
+    g, argocd_users, role:readonly
     g, mcpserver, role:app-manager
     g, homepage, role:app-viewer
   policy.default: role:readonly
-  scopes: '[groups, email]'
+  scopes: '[groups]'