diff --git a/dankclaw/observability/quadlet/grafana.container b/dankclaw/observability/quadlet/grafana.container
index 8eefb6f..112b724 100644
--- a/dankclaw/observability/quadlet/grafana.container
+++ b/dankclaw/observability/quadlet/grafana.container
@@ -47,11 +47,12 @@ Environment=GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=${GRAFANA_OAUTH_CLIENT_SECRET}
 # client_id query parameter — /application/o/<slug>/authorize/ does not exist.
 Environment=GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://auth.franksdank.cloud/application/o/authorize/
 Environment=GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://auth.franksdank.cloud/application/o/token/
-# Read claims from the signed ID token. Grafana v13 always appends /emails to
-# API_URL and GETs it as a userinfo endpoint (authentik has no such path and
-# 404s it, failing the login). USE_ID_TOKEN makes Grafana take sub/email/name
-# from the id_token, which authentik fills from the openid/email/profile scopes.
-Environment=GF_AUTH_GENERIC_OAUTH_USE_ID_TOKEN=true
+# Standard OIDC userinfo. Grafana v13 fetches <api_url>/emails for the address
+# ONLY when the token carries no `email` claim (authentik has no /emails path and
+# 404s it, failing the login) — so the claim must actually be there: the fix is
+# the grafana-email-scope mapping (see scripts/authentik-grafana-sso-fix.sh),
+# not a Grafana flag. Do NOT append ?api=1 to this URL: Grafana then GETs
+# <...>/userinfo/?api=1/emails, a 403.
 Environment=GF_AUTH_GENERIC_OAUTH_API_URL=https://auth.franksdank.cloud/application/o/userinfo/
 # authentik's scopes are openid/email/profile. `user:email` (a GitLab-ism) is
 # not a known scope here; requesting it makes the authorize view crash.
diff --git a/scripts/authentik-grafana-sso-fix.sh b/scripts/authentik-grafana-sso-fix.sh
index 19077c7..d31ce8b 100755
--- a/scripts/authentik-grafana-sso-fix.sh
+++ b/scripts/authentik-grafana-sso-fix.sh
@@ -29,8 +29,8 @@
 # facts and the symptom returns verbatim. Re-run this after any such rebuild.
 # Every step is idempotent.
 #
-# Grafana's own half — SCOPES="openid email profile", USE_ID_TOKEN=true, no
-# `?api=1` on the API URL, ALLOW_SIGN_UP=true — lives in
+# Grafana's own half — SCOPES="openid email profile", a standard userinfo API_URL
+# with no `?api=1`, and ALLOW_SIGN_UP=true — lives in
 # dankclaw/observability/quadlet/grafana.container and deploys normally.
 #
 # Usage: authentik-grafana-sso-fix.sh          (override host: AUTHENTIK_HOST=…)