diff --git a/nextcloud_mcp_server/app.py b/nextcloud_mcp_server/app.py
index 5bdedf86..3fa99a47 100644
--- a/nextcloud_mcp_server/app.py
+++ b/nextcloud_mcp_server/app.py
@@ -1789,10 +1789,19 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
                         )
                         break
 
-                # Determine authentication mode for background sync
-                # Login Flow v2 and multi-user BasicAuth: use app passwords
-                # OAuth mode (without Login Flow): use OAuth refresh tokens
-                use_basic_auth = not oauth_enabled or settings.enable_login_flow
+                # Background sync always uses app passwords post-ADR-022:
+                # `oauth_enabled` now implies `enable_login_flow` (single
+                # source of truth is `MCP_DEPLOYMENT_MODE`), so the old
+                # `not oauth_enabled or settings.enable_login_flow` was always
+                # True. The OAuth-refresh code paths in
+                # `vector/oauth_sync.py` (gated on `use_basic_auth=False`)
+                # are now unreachable; pruning them — and dropping the
+                # `use_basic_auth` parameter from `user_manager_task` /
+                # `oauth_processor_task` — is tracked as a separate
+                # follow-up. Keep the variable name + the conditional
+                # wiring at the call sites for now so the parallel-prune
+                # PR is a clean mechanical diff.
+                use_basic_auth = True
 
                 # Start background tasks using anyio TaskGroup
                 async with anyio.create_task_group() as tg:
diff --git a/nextcloud_mcp_server/config.py b/nextcloud_mcp_server/config.py
index 62eca989..25347c21 100644
--- a/nextcloud_mcp_server/config.py
+++ b/nextcloud_mcp_server/config.py
@@ -43,8 +43,9 @@ _DEFAULTS: dict[str, Any] = {
     "userinfo_uri": None,
     "oidc_resource_server_id": None,
     # Mode flags
-    "enable_multi_user_basic_auth": False,
-    "enable_login_flow": False,
+    # NOTE: `enable_multi_user_basic_auth` and `enable_login_flow` are
+    # intentionally absent — they are derived from MCP_DEPLOYMENT_MODE in
+    # Settings.__post_init__ (ADR-022) and not read from the dynaconf store.
     "enable_semantic_search": False,
     "enable_background_operations": False,
     "vector_sync_enabled": False,