diff --git a/scripts/iam/zitadel-provision.py b/scripts/iam/zitadel-provision.py
index 6ca8b84..a5054cf 100755
--- a/scripts/iam/zitadel-provision.py
+++ b/scripts/iam/zitadel-provision.py
@@ -143,8 +143,13 @@ OIDC_APPS = {
         "https://paperless.riotpiao.com/accounts/oidc/zitadel/login/callback/",
         "http://localhost:8000/accounts/oidc/authentik/login/callback/",
         "https://paperless.riotpiao.com/accounts/oidc/authentik/login/callback/"]},
+    # The frontend calls back at /auth/callback (see OAUTH_CALLBACK_PATH in
+    # poimen-frontend/lib/oauth.ts). The bare /callback spelling stays registered so
+    # an older image still completes its login.
     "poimen": {**_WEB, "redirect_uris": [
-        "http://localhost:3000/callback", "https://poimen.riotpiao.com/callback"]},
+        "http://localhost:3000/callback", "https://poimen.riotpiao.com/callback",
+        "http://localhost:3000/auth/callback",
+        "https://poimen.riotpiao.com/auth/callback"]},
     "queue-sqs": {**_WEB, "redirect_uris": [
         "http://localhost:8080/callback", "https://queue.riotpiao.com/callback"]},
     "vault": {**_WEB, "redirect_uris": [