diff --git a/backend/internal/auth/oidc.go b/backend/internal/auth/oidc.go
index 5b2418e..c3a4ad8 100644
--- a/backend/internal/auth/oidc.go
+++ b/backend/internal/auth/oidc.go
@@ -64,7 +64,23 @@ func (p *OIDCProvider) Configure(ctx context.Context, cfg config.OIDCConfig, red
 		return nil
 	}
 
-	provider, err := oidc.NewProvider(ctx, strings.TrimRight(cfg.Issuer, "/"))
+	// go-oidc strictly checks that the issuer we pass matches the issuer field
+	// in the discovery document. Providers differ on the trailing slash
+	// (Authentik returns ".../application/o/<slug>/" WITH a slash), so try the
+	// value verbatim first and then the alternate slash form.
+	issuer := strings.TrimSpace(cfg.Issuer)
+	provider, err := oidc.NewProvider(ctx, issuer)
+	if err != nil {
+		var alt string
+		if strings.HasSuffix(issuer, "/") {
+			alt = strings.TrimRight(issuer, "/")
+		} else {
+			alt = issuer + "/"
+		}
+		if provider2, err2 := oidc.NewProvider(ctx, alt); err2 == nil {
+			provider, err = provider2, nil
+		}
+	}
 	if err != nil {
 		return err
 	}