diff --git a/CLAUDE.md b/CLAUDE.md
index e96b5e5..de44be3 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -113,13 +113,13 @@ If the service has built-in OAuth2/OIDC login (Immich, Paperless-ngx, Gitea, etc
      "redirect_uris": [{"matching_mode": "strict", "url": "https://<slug>.ginnoir.com/auth/callback"}],
      "authorization_flow": "b88daebc-c54d-4e85-ae27-8b47384d5d74",
      "invalidation_flow": "3259f9c5-7eab-40bf-81cb-2b0ede6eb7b3",
-     "property_mappings": ["718abef2-...", "19491dd8-...", "ca45a8da-..."],
+     "property_mappings": ["718abef2-504c-452c-9ff0-329eda8031c7", "19491dd8-d239-41a4-aa48-030c1471779d", "ca45a8da-db62-41ba-b1c4-e669bf3c9a82"],
      "sub_mode": "hashed_user_id",
-     "grant_types": ["authorization_code", "hybrid", "implicit", "client_credentials", "password", "urn:ietf:params:oauth:grant-type:device_code", "refresh_token"],
+     "grant_types": ["authorization_code", "refresh_token"],
      "signing_key": "dc7cbd9e-c6d2-4168-b402-e7570bcb59d1"
    }
    ```
-   **IMPORTANT:** `grant_types` and `signing_key` must be set explicitly — the API defaults `grant_types` to `[]` (empty = all auth requests rejected as `invalid_request`) and leaves `signing_key` null (tokens can't be signed).
+   **IMPORTANT:** `grant_types` and `signing_key` must be set explicitly — the API defaults `grant_types` to `[]` (empty = all auth requests rejected as `invalid_request`) and leaves `signing_key` null (tokens can't be signed). Use `UpdateOauth2Provider` to fix an existing broken provider.
    Note the returned `pk`, `client_id`, and `client_secret`.
 
 2. **Create an Authentik application** → `POST /api/v3/core/applications/`: