diff --git a/scripts/authentik-setup.py b/scripts/authentik-setup.py
index 3b1fd65..9de1df8 100644
--- a/scripts/authentik-setup.py
+++ b/scripts/authentik-setup.py
@@ -118,10 +118,13 @@ def ensure_portal_app(apps):
             "authorization_flow": template["authorization_flow"],
             "invalidation_flow": template["invalidation_flow"],
             "client_type": "confidential",
+            # Neuere Authentik-Versionen setzen per API keine Standard-Grant-Types;
+            # ohne diese Liste lehnt Authentik jede Anmeldung als "malformed" ab.
+            "grant_types": ["authorization_code", "refresh_token"],
             "redirect_uris": [
-                {"matching_mode": "strict", "url": f"{PORTAL_URL}/auth/callback"},
+                {"matching_mode": "strict", "url": f"{PORTAL_URL}/auth/callback", "redirect_uri_type": "authorization"},
                 # Rücksprung nach dem Abmelden (post_logout_redirect_uri)
-                {"matching_mode": "strict", "url": f"{PORTAL_URL}/"},
+                {"matching_mode": "strict", "url": f"{PORTAL_URL}/", "redirect_uri_type": "logout"},
             ],
             "property_mappings": template["property_mappings"],
             "signing_key": template.get("signing_key"),