diff --git a/config/permissions/akP-mediamark-user.yaml b/config/permissions/akP-mediamark-user.yaml
new file mode 100644
index 0000000..a7f1e22
--- /dev/null
+++ b/config/permissions/akP-mediamark-user.yaml
@@ -0,0 +1,4 @@
+# Permission group akP-mediamark-user (name = filename). Grants user access to
+# mediamark: bound to the mediamark application, gating the kids-content
+# marking UI.
+application: mediamark
diff --git a/config/permissions/akP-mediamark.yaml b/config/permissions/akP-mediamark.yaml
deleted file mode 100644
index f60aba0..0000000
--- a/config/permissions/akP-mediamark.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-# Permission group akP-mediamark (name = filename). Grants access to mediamark:
-# bound to the mediamark application, gating the kids-content marking UI.
-application: mediamark
diff --git a/config/providers_oauth2/mediamark.yaml b/config/providers_oauth2/mediamark.yaml
index 6551cbc..5114ca8 100644
--- a/config/providers_oauth2/mediamark.yaml
+++ b/config/providers_oauth2/mediamark.yaml
@@ -1,9 +1,10 @@
 # OAuth2/OIDC provider + application for mediamark (the Go web UI for marking
 # media as kids content, served at https://mediamark.unkin.net (external
 # hostname) and https://mediamark.k8s.syd1.au.unkin.net (cluster hostname) in
-# the arrstack namespace). An oauth2-proxy in front of the UI performs the OIDC
-# login with a relative redirect, so both hostnames must be registered; access
-# is gated on the user's hierarchical ak_groups claim (akP-mediamark).
+# its own mediamark namespace). An oauth2-proxy in front of the UI performs the
+# OIDC login with a relative redirect, so both hostnames must be registered;
+# access is gated on the user's hierarchical ak_groups claim
+# (akP-mediamark-user).
 # client_secret is read from Vault (seeded out of band), never committed.
 name: mediamark
 authorization_flow: default-provider-authorization-implicit-consent
@@ -13,7 +14,7 @@ client_id: mediamark
 launch_url: https://mediamark.unkin.net/
 client_secret_vault:
   mount: kv
-  path: kubernetes/namespace/arrstack/default/mediamark-oauth-credentials
+  path: kubernetes/namespace/mediamark/default/oauth-credentials
 scope_mappings:
   - goauthentik.io/providers/oauth2/scope-openid
   - goauthentik.io/providers/oauth2/scope-email
diff --git a/config/roles/akR-media-adult.yaml b/config/roles/akR-media-adult.yaml
index c898d49..13620d1 100644
--- a/config/roles/akR-media-adult.yaml
+++ b/config/roles/akR-media-adult.yaml
@@ -3,9 +3,9 @@
 # per-service entitlements. Membership propagates child -> parent, so a member
 # appears in both permission groups in the hierarchical `ak_groups` claim and the
 # media proxy routes/authorizes them for fafflix and cheeztv. Adults also curate
-# which titles are kids content, so the role nests akP-mediamark for access to
-# the mediamark UI.
+# which titles are kids content, so the role nests akP-mediamark-user for access
+# to the mediamark UI.
 permissions:
   - akP-media-fafflix
   - akP-media-cheeztv
-  - akP-mediamark
+  - akP-mediamark-user