diff --git a/flux2/core/base/single-sign-on/release.yaml b/flux2/core/base/single-sign-on/release.yaml
index 7d97712e7824b3a70756f2d4d23cd450cad8a3bc..93e5e45a3c521cbe0354ac4f920a1293f0435f5e 100644
--- a/flux2/core/base/single-sign-on/release.yaml
+++ b/flux2/core/base/single-sign-on/release.yaml
@@ -152,8 +152,8 @@ spec:
     # https://github.com/wekan/wekan/wiki/Keycloak
     - clientName: *WEKAN
       clientSecret: "${wekan_oauth_client_secret}"
-      redirectUri: "https://wekan.${domain}/auth"
-      scopes: "openid profile email openappstack_roles"
+      redirectUri: "https://wekan.${domain}/_oauth/oidc"
+      scopes: "openid profile email"
       clientUri: "https://wekan.${domain}"
       clientLogoUri: "https://wekan.${domain}/wekan-logo.svg"
       tokenEndpointAuthMethod: "client_secret_post"