diff --git a/deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml b/deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml
index cc36768..ae4c763 100644
--- a/deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml
+++ b/deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml
@@ -196,9 +196,14 @@ spec:
                   name: knoe-auth-google-oidc
                   key: hosted_domain
                   optional: true   # blank = any Google account; set to restrict to Workspace domain
+            # ── prole.org base URL (used for Google OAuth2 redirect_uri) ────────
+            # LoginController.java: @Value("${KNOE_AUTH_BASE_URL:https://api.0.knoe.dev/auth}")
+            # Must be set to the public-facing auth prefix for this cluster.
+            - name: KNOE_AUTH_BASE_URL
+              value: "https://api.prole.org/auth"
             # ── prole.org Google OAuth2 login (Path A) ───────────────────────
             # Real values: bao/kv/knoe/oauth2/google-prole-org
-            # Secret template: deploy/opentofu/k3s/manifests/knoe/knoe-auth-http-keytab-secret.example.yaml
+            # Secret template: deploy/opentofu/k3s/manifests/knoe/knoe-auth-google-prole-secret.example.yaml
             - name: GOOGLE_PROLE_CLIENT_ID
               valueFrom:
                 secretKeyRef:
diff --git a/deploy/opentofu/k3s/manifests/knoe/knoe-auth-google-prole-secret.example.yaml b/deploy/opentofu/k3s/manifests/knoe/knoe-auth-google-prole-secret.example.yaml
index c555703..9a03262 100644
--- a/deploy/opentofu/k3s/manifests/knoe/knoe-auth-google-prole-secret.example.yaml
+++ b/deploy/opentofu/k3s/manifests/knoe/knoe-auth-google-prole-secret.example.yaml
@@ -11,8 +11,8 @@ metadata:
 #      https://console.cloud.google.com/apis/credentials
 #    Application type: Web application
 #    Authorized redirect URIs:
-#      https://api.prole.org/auth/auth/callback/google
-#      https://api.prole.org/auth/auth/enroll/google-callback
+#      https://api.prole.org/auth/callback/google
+#      https://api.prole.org/auth/enroll/google-callback
 #
 # 2. Store real values in OpenBao:
 #      bao kv put knoe/oauth2/google-prole-org \
diff --git a/deploy/opentofu/k3s/manifests/knoe/oauth2-proxy-deployment-prole.yaml b/deploy/opentofu/k3s/manifests/knoe/oauth2-proxy-deployment-prole.yaml
index 46c6c0b..de07746 100644
--- a/deploy/opentofu/k3s/manifests/knoe/oauth2-proxy-deployment-prole.yaml
+++ b/deploy/opentofu/k3s/manifests/knoe/oauth2-proxy-deployment-prole.yaml
@@ -80,7 +80,11 @@ spec:
           image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2
           imagePullPolicy: IfNotPresent
           args:
-            - --provider=google
+            # Switched from --provider=google to OIDC via knoe-auth (Phase 2).
+            # Authentication flow: oauth2-proxy → knoe-auth /authorize → Google → knoe-auth /callback/google → oauth2-proxy /callback
+            # The db-prole-org Google OAuth client (https://db.prole.org/oauth2/callback) is now unused.
+            - --provider=oidc
+            - --oidc-issuer-url=https://api.prole.org/auth
             - --email-domain=prole.org
             - --upstream=http://supabase-kong:8000
             - --http-address=0.0.0.0:4180