diff --git a/nextcloud_mcp_server/app.py b/nextcloud_mcp_server/app.py
index 551b4bcc..55028f23 100644
--- a/nextcloud_mcp_server/app.py
+++ b/nextcloud_mcp_server/app.py
@@ -1807,9 +1807,9 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
                         break
 
                 # Determine authentication mode for background sync
-                # Multi-user BasicAuth: use app passwords via Astrolabe (NOT OAuth)
-                # OAuth mode: use OAuth refresh tokens (NOT app passwords)
-                use_basic_auth = not oauth_enabled
+                # Login Flow v2 and multi-user BasicAuth: use app passwords
+                # OAuth mode (without Login Flow): use OAuth refresh tokens
+                use_basic_auth = not oauth_enabled or settings.enable_login_flow
 
                 # Start background tasks using anyio TaskGroup
                 async with anyio.create_task_group() as tg:
diff --git a/nextcloud_mcp_server/vector/oauth_sync.py b/nextcloud_mcp_server/vector/oauth_sync.py
index 5f6a5b9e..615977e1 100644
--- a/nextcloud_mcp_server/vector/oauth_sync.py
+++ b/nextcloud_mcp_server/vector/oauth_sync.py
@@ -489,21 +489,13 @@ async def user_manager_task(
         try:
             # Get current provisioned users based on mode
             if use_basic_auth:
-                # BasicAuth mode: query app_passwords table
+                # BasicAuth / Login Flow v2 mode: query app_passwords table
                 provisioned_users = set(
                     await refresh_token_storage.get_all_app_password_user_ids()
                 )
             else:
                 # OAuth mode: query refresh_tokens table
                 provisioned_users = set(await refresh_token_storage.get_all_user_ids())
-                # Login Flow mode: also check app_passwords table
-                # (users provisioned via Login Flow v2 have app passwords,
-                # not refresh tokens)
-                if settings.enable_login_flow:
-                    app_pw_users = set(
-                        await refresh_token_storage.get_all_app_password_user_ids()
-                    )
-                    provisioned_users |= app_pw_users
             active_users = set(user_states.keys())
 
             # Start scanners for new users