diff --git a/apps/authentik/authentik-blueprints.yaml b/apps/authentik/authentik-blueprints.yaml
index 58a2e8c..af77fdb 100644
--- a/apps/authentik/authentik-blueprints.yaml
+++ b/apps/authentik/authentik-blueprints.yaml
@@ -422,53 +422,47 @@ data:
           meta_publisher: aXionGaming
           policy_engine_mode: any
           open_in_new_tab: false
-  wiki-forward-auth.yaml: |
+  wiki-oidc-provider.yaml: |
     # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
     version: 1
     metadata:
-      name: wiki-forward-auth
+      name: wiki-oidc-provider
       labels:
         blueprints.goauthentik.io/instantiate: "true"
     entries:
-      # Proxy-Provider im Forward-Auth-Modus. Kein internal_host (das wäre der
-      # Proxy-Modus) — forward_single reicht Traefik nur das Ja/Nein zurück.
-      - model: authentik_providers_proxy.proxyprovider
+      - model: authentik_providers_oauth2.oauth2provider
         state: present
         identifiers:
-          name: ThreadNet Wiki
-        id: wiki_proxy_provider
+          name: ThreadNet Wiki (Wiki.js)
+        id: wiki_oidc_provider
         attrs:
-          mode: forward_single
-          external_host: https://axionwiki.lab
+          client_type: confidential
+          client_id: !Env AUTHENTIK_WIKI_OIDC_CLIENT_ID
+          client_secret: !Env AUTHENTIK_WIKI_OIDC_CLIENT_SECRET
+          # Aus Wiki.js übernehmen (Teil 3 zeigt die Callback-URL nach Anlegen
+          # der Strategy). Erst danach hier eintragen:
+          redirect_uris:
+            - matching_mode: strict
+              url: https://wiki.axion1337.chat/login/PROVIDERKEY/callback
+          sub_mode: hashed_user_id
+          include_claims_in_id_token: true
           authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
           invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          access_token_validity: hours=24
+          property_mappings:
+            - !Find [authentik_core.propertymapping, [managed, "goauthentik.io/providers/oauth2/scope-openid"]]
+            - !Find [authentik_core.propertymapping, [managed, "goauthentik.io/providers/oauth2/scope-email"]]
+            - !Find [authentik_core.propertymapping, [managed, "goauthentik.io/providers/oauth2/scope-profile"]]
+            # + Gruppen-Claim: entweder das mitgelieferte Groups-Scope-Mapping
+            #   (falls vorhanden) oder ein eigenes Scope-Mapping, das "groups"
+            #   zurückgibt — nötig für Rollen/Abschottung (#0049).
 
       - model: authentik_core.application
         state: present
         identifiers:
-          slug: wiki
-        id: wiki_app
+          slug: wiki-js
         attrs:
           name: ThreadNet Wiki
-          provider: !KeyOf wiki_proxy_provider
-          meta_description: Internes Docusaurus-Wiki, nur Gruppe wiki-zugang
+          provider: !KeyOf wiki_oidc_provider
+          meta_description: Internes Wiki (Betrieb/Anwender), Zugriff nach Gruppe
           policy_engine_mode: any
-          open_in_new_tab: true
-
-      # Zugangsbeschränkung: nur Mitglieder dieser Gruppe passieren das Tor.
-      - model: authentik_core.group
-        state: present
-        identifiers:
-          name: wiki-zugang
-        id: wiki_group
-
-      - model: authentik_policies.policybinding
-        state: present
-        identifiers:
-          target: !KeyOf wiki_app
-          group: !KeyOf wiki_group
-          order: 0
-        attrs:
-          enabled: true
-          negate: false
+          open_in_new_tab: false