diff --git a/dankclaw/open-webui/quadlet/open-webui.container b/dankclaw/open-webui/quadlet/open-webui.container
index 37c9951..c46d9c3 100644
--- a/dankclaw/open-webui/quadlet/open-webui.container
+++ b/dankclaw/open-webui/quadlet/open-webui.container
@@ -41,9 +41,11 @@ Environment=DO_NOT_TRACK=True
 # server-side code exchange works from this bridge. Roles come from the
 # "Open WebUI roles" scope mapping (entitlements "Open WebUI Users" /
 # "Open WebUI Admins"); OAUTH_MERGE_ACCOUNTS_BY_EMAIL folds SSO logins into
-# the existing local account (frank8465@protonmail.com). These vars SEED the
-# per-key config DB on first run (fill-missing only); on the live data dir
-# the Admin Panel is authoritative.
+# the existing local account (frank8465@protonmail.com). The OAuth vars are
+# read directly from the environment at runtime (the per-key config DB holds
+# only Admin-Panel overrides, so nothing is seeded on the live data dir).
+# NOTE: the OAUTH_SCOPES value MUST stay quoted — systemd splits unquoted
+# Environment= values on whitespace (unquoted, only "openid" survived).
 EnvironmentFile=/home/dank/Containers/open-webui/env
 Environment=OAUTH_CLIENT_ID=KmtzKc0bjWjaIFeM0puYudI1CLXR2p0jnPCSf4N0
 Environment=OAUTH_PROVIDER_NAME=authentik
@@ -52,7 +54,7 @@ Environment=OPENID_REDIRECT_URI=https://ai.franksdank.cloud/oauth/oidc/callback
 Environment=WEBUI_URL=https://ai.franksdank.cloud
 Environment=ENABLE_OAUTH_SIGNUP=true
 Environment=OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
-Environment=OAUTH_SCOPES=openid email profile roles
+Environment="OAUTH_SCOPES=openid email profile roles"
 Environment=ENABLE_OAUTH_ROLE_MANAGEMENT=true
 
 # Web search -> SearXNG, reached over the host-published port (NOT the