diff --git a/k8s/apps/paperless/paperless-ai.yaml b/k8s/apps/paperless/paperless-ai.yaml
index 81d9e2b..29a62d3 100644
--- a/k8s/apps/paperless/paperless-ai.yaml
+++ b/k8s/apps/paperless/paperless-ai.yaml
@@ -65,7 +65,12 @@ spec:
             - --user-id=397072668735570071
             - --key-id=397072674272051351
             - --key-file=/var/run/llm-key/key
-            - --scope=openid urn:zitadel:iam:org:project:id:396757796898471937:aud
+            # No project audience. ZITADEL puts the requested audience in `aud`, and
+            # the gateway compares `aud` with its allow-list of client ids. Asking for
+            # the project id made every token carry the project, so the gateway
+            # answered "audience not allowed: [396757796898471937]". With plain
+            # `openid` the token names its caller, which is the entry that exists.
+            - --scope=openid
             - --out=/app/data/llm_token.txt
           volumeMounts:
             - {name: paperless-ai-data, mountPath: /app/data}