diff --git a/web/index.php b/web/index.php
index 8f4a923..fb74276 100644
--- a/web/index.php
+++ b/web/index.php
@@ -3,7 +3,7 @@ session_start();
 ?>
 <!DOCTYPE html>
 <html>
-<head><title>Fitness – OIDC Demo</title></head>
+<head><title>Fitness - OIDC Demo</title></head>
 <body>
 <?php if (!isset($_SESSION['user'])): ?>
     <a href="/login.php"><button>Login with Authelia</button></a>
diff --git a/web/login.php b/web/login.php
index a746f98..a5637d1 100644
--- a/web/login.php
+++ b/web/login.php
@@ -4,20 +4,25 @@ require __DIR__ . '/vendor/autoload.php';
 session_start();
 
 $oidc = new \Jumbojett\OpenIDConnectClient(
-    'https://auth.matt-cloud.com/oidc',
+    'https://auth.matt-cloud.com/',    // ***ISSUER***
     'fitness-oidc',
     'egebuqzZfVnjjBG9JDQ8tjW3TzV9gJurvT7qfB6c2SX2nPBNeaGycDfx4788QzJd'
 );
 
-// Tell the client where the user should be redirected after Auth
-$oidc->setRedirectURL('https://fitness.matt-cloud.com/pgapi/auth/oidc/callback');
+// If you’re on a dev environment with a self‑signed cert:
+# $oidc->setVerifyPeer(false);   // <-- DO NOT USE IN PRODUCTION
 
-// If you want PKCE (recommended for public clients)
+// PKCE – optional but recommended for public clients
 $oidc->setCodeChallengeMethod('S256');
 
-// Start the auth flow
+// Tell the client where to land after Auth
+$oidc->setRedirectURL('https://fitness.matt-cloud.com/pgapi/auth/oidc/callback');
+
+// Optional: hard‑code the discovery URL
+$oidc->setDiscoveryEndpoint('https://auth.matt-cloud.com/.well-known/openid-configuration');
+
 try {
-    $oidc->authenticate();      // will redirect to Authelia
+    $oidc->authenticate();   // sends 302 → Authelia
 } catch (Exception $e) {
     http_response_code(500);
     echo 'Login failed: ' . $e->getMessage();