diff --git a/config/providers_oauth2/stalwart.yaml b/config/providers_oauth2/stalwart.yaml
index d92c73a..e35a8bf 100644
--- a/config/providers_oauth2/stalwart.yaml
+++ b/config/providers_oauth2/stalwart.yaml
@@ -2,20 +2,19 @@
 # https://mail.unkin.net in the mail namespace). Stalwart's OIDC directory
 # validates access tokens (JWT, userinfo fallback) and requires aud=stalwart
 # plus the openid+email scopes; it maps preferred_username/name from profile.
-# client_secret is read from Vault (seeded out of band), never committed.
+# public, no secret: the web UI uses PKCE; the strict redirect URIs are the control.
 name: stalwart
 authorization_flow: default-provider-authorization-implicit-consent
 invalidation_flow: default-provider-invalidation-flow
-client_type: confidential
+client_type: public
 client_id: stalwart
 launch_url: https://mail.unkin.net/
-client_secret_vault:
-  mount: kv
-  path: kubernetes/namespace/mail/default/oauth-credentials
 scope_mappings:
   - goauthentik.io/providers/oauth2/scope-openid
   - goauthentik.io/providers/oauth2/scope-email
   - goauthentik.io/providers/oauth2/scope-profile
 redirect_uris:
   - matching_mode: strict
-    url: https://mail.unkin.net/oauth2/callback
+    url: https://mail.unkin.net/account/oauth/callback
+  - matching_mode: strict
+    url: https://mail.unkin.net/admin/oauth/callback