diff --git a/docs/login-flow-v2.md b/docs/login-flow-v2.md
index f7957f1a..4babbfa8 100644
--- a/docs/login-flow-v2.md
+++ b/docs/login-flow-v2.md
@@ -87,7 +87,7 @@ DCR clients after ~1 hour (see [Troubleshooting](#access-forbidden-after-the-con
    - **Redirect URI:** `https://<your-mcp-server>/oauth/callback`
    - **Flow / response type:** authorization **code**
    - **Type:** **confidential** (so it issues a client secret)
-   - **Resource identifier:** `https://<your-mcp-server>/mcp` (so issued tokens carry the MCP server's audience)
+   - **Resource identifier:** `https://<your-mcp-server>/mcp` (so issued tokens carry the MCP server's audience; the verifier's `_has_mcp_audience` accepts both this `/mcp` form and the bare server URL)
    - **Scopes:** leave empty to allow all, or list the per-app scopes you want plus `openid profile email offline_access`
 3. Copy the generated client ID and secret into `NEXTCLOUD_OIDC_CLIENT_ID` /
    `NEXTCLOUD_OIDC_CLIENT_SECRET`.
@@ -369,7 +369,9 @@ cached that now-deleted client in `tokens.db` and keeps reusing it.
 see [Default IdP setup](#default-idp-setup-nextclouds-built-in-oidc-app). Static
 clients are never auto-deleted. Set `NEXTCLOUD_OIDC_CLIENT_ID` /
 `NEXTCLOUD_OIDC_CLIENT_SECRET` (they take precedence over the cached DCR client)
-and recreate the container.
+and recreate the container. Existing users will need to re-authorize once after
+this switch — their stored sessions were issued to the now-deleted DCR client,
+so old refresh tokens no longer validate against the new static client.
 
 As a non-recommended stopgap you can extend the DCR client lifetime globally:
 `occ config:app:set oidc client_expire_time --value 31536000`.
diff --git a/env.sample.oauth-multi-user b/env.sample.oauth-multi-user
index 4368f307..61bf205f 100644
--- a/env.sample.oauth-multi-user
+++ b/env.sample.oauth-multi-user
@@ -27,8 +27,8 @@ MCP_DEPLOYMENT_MODE=login_flow
 # registers an ephemeral client that the app deletes after ~1h, which breaks
 # auth permanently ("Access forbidden" on reconnect — see issue #907).
 # Create one under Administration settings -> OpenID Connect provider.
-NEXTCLOUD_OIDC_CLIENT_ID=your-client-id
-NEXTCLOUD_OIDC_CLIENT_SECRET=your-client-secret
+NEXTCLOUD_OIDC_CLIENT_ID=<your-client-id>
+NEXTCLOUD_OIDC_CLIENT_SECRET=<your-client-secret>
 
 # MCP Server URL (for OAuth redirects)
 NEXTCLOUD_MCP_SERVER_URL=http://localhost:8000