diff --git a/sso-mfa/k8s/keycape/create-secrets.sh b/sso-mfa/k8s/keycape/create-secrets.sh
index 4f7a2d6..d99723c 100644
--- a/sso-mfa/k8s/keycape/create-secrets.sh
+++ b/sso-mfa/k8s/keycape/create-secrets.sh
@@ -91,19 +91,17 @@ privacyidea:
   realm: "netkingdom"
 
 # ── OIDC client registrations ─────────────────────────────────────────────────
-# Add one entry per downstream application.
 # clientType: "public" for SPAs/native apps (PKCE, no client secret)
 #             "confidential" for server-side apps (client secret required)
-clients: []
-# Example:
-# clients:
-#   - clientId: "my-app"
-#     displayName: "My Application"
-#     redirectUris:
-#       - "https://my-app.coulomb.social/callback"
-#     allowedScopes: ["openid", "profile", "email", "groups"]
-#     grantTypes: ["authorization_code"]
-#     clientType: "public"
+clients:
+  - clientId: "demo-app"
+    displayName: "Demo Application"
+    redirectUris:
+      - "http://localhost:3000/callback"
+      - "https://demo.coulomb.social/callback"
+    allowedScopes: ["openid", "profile", "email", "groups"]
+    grantTypes: ["authorization_code"]
+    clientType: "public"
 EOF
 )
 
diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml
index 88db30d..a6754a1 100644
--- a/sso-mfa/k8s/keycape/deployment.yaml
+++ b/sso-mfa/k8s/keycape/deployment.yaml
@@ -49,13 +49,10 @@ spec:
 
       containers:
         - name: keycape
-          # EDIT before applying — see README.md "Building the image".
-          # Option A (registry):  docker build -t <registry>/keycape:v0.1 ~/key-cape/ && docker push ...
-          # Option B (K3s local): docker build -t keycape:v0.1 ~/key-cape/ &&
-          #                       docker save keycape:v0.1 | sudo k3s ctr images import -
-          # After Option B, set imagePullPolicy: Never.
-          image: keycape:v0.1
-          imagePullPolicy: IfNotPresent
+          # Image published to self-hosted Gitea OCI registry on CoulombCore (KEY-WP-0002).
+          # k3s insecure registry configured for 92.205.130.254:32166 — no pull secret needed.
+          image: 92.205.130.254:32166/coulomb/key-cape:latest
+          imagePullPolicy: Always
 
           ports:
             - name: http