diff --git a/platform/crafty/deployment.yaml b/platform/crafty/deployment.yaml
index 1566849..8bcd53d 100644
--- a/platform/crafty/deployment.yaml
+++ b/platform/crafty/deployment.yaml
@@ -135,7 +135,7 @@ spec:
             - --oidc-groups-claim=groups
             # R-IDP-06: a valid Keycloak session is NOT enough — the user must ALSO be in platform-admins,
             # else /oauth2 returns 403. (Matches the platform oauth2-proxy floor.)
-            - --allowed-groups=platform-admins
+            - --allowed-group=platform-admins
             # Single provider => 302 straight to Keycloak, no oauth2-proxy interstitial button.
             - --skip-provider-button=true
             - --redirect-url=https://crafty.home.keithjackson.dev/oauth2/callback
diff --git a/platform/oauth2-proxy/helmrelease.yaml b/platform/oauth2-proxy/helmrelease.yaml
index f4fa869..2c741d6 100644
--- a/platform/oauth2-proxy/helmrelease.yaml
+++ b/platform/oauth2-proxy/helmrelease.yaml
@@ -57,7 +57,7 @@ spec:
       # HTTPRoute's `homelab.keithjackson.dev/auth-groups` annotation — oauth2-proxy honours the
       # per-request query on top of this floor. See forward-auth-cec.yaml + README "opt-in".
       oidc-groups-claim: groups
-      allowed-groups: platform-admins    # R-IDP-06 floor: authenticated AND in platform-admins
+      allowed-group: platform-admins    # R-IDP-06 floor: authenticated AND in platform-admins (oauth2-proxy flag is singular --allowed-group, repeatable)
       # Single Keycloak provider => skip the oauth2-proxy interstitial "Sign In" button and 302
       # straight to Keycloak. Verified in-cluster: WITHOUT this, an ext_authz-denied browser request
       # gets oauth2-proxy's HTML sign-in page (HTTP 403) instead of an immediate redirect (docs/15 UX).