diff --git a/config/providers_oauth2/gitea.yaml b/config/providers_oauth2/gitea.yaml
index 751194e..5169eac 100644
--- a/config/providers_oauth2/gitea.yaml
+++ b/config/providers_oauth2/gitea.yaml
@@ -17,9 +17,9 @@ scope_mappings:
   - goauthentik.io/providers/oauth2/scope-email
   - goauthentik.io/providers/oauth2/scope-profile
 redirect_uris:
-  # Temporary validation host.
-  - matching_mode: strict
-    url: https://git2.k8s.syd1.au.unkin.net/user/oauth2/authentik/callback
-  # Final host (active after DNS/cert cutover).
+  # Canonical/production host (active after the git.unkin.net DNS cutover).
   - matching_mode: strict
     url: https://git.unkin.net/user/oauth2/authentik/callback
+  # Admin/backup route (live now via external-dns), used for validation too.
+  - matching_mode: strict
+    url: https://git.k8s.syd1.au.unkin.net/user/oauth2/authentik/callback