diff --git a/CLAUDE.md b/CLAUDE.md
index af0485b..46ac4e7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -46,6 +46,18 @@ One login instead of logging into Proxmox, Zabbix, OMV, and every service separa
   current URL (Fastify never sees HTTPS, it terminates upstream), sending the wrong scheme as
   `redirect_uri` in the token exchange. Both are exactly the class of bug curl-based verification cannot
   catch — real redirect chains and a real IdP login form need a real browser.
+- **Sign-out ends the full Authentik session, not just the app session** (issue #19, done): RP-Initiated
+  Logout via `openid-client`'s `buildEndSessionUrl` (`apps/api/src/auth/oidc.ts`), full-page navigation
+  (not `fetch`) so Authentik's browser cookie actually clears. Two more bugs found only via full
+  click-through testing, same pattern as above: the provider's `invalidation_flow` was initially
+  app-scoped (`default-provider-invalidation-flow`), which silently left Authentik's own session valid —
+  fixed by switching to `default-invalidation-flow`; and the provider had no `property_mappings`, so the
+  ID token never carried `preferred_username`/`email` and the UI showed the raw `sub` hash (with
+  `sub_mode: hashed_user_id`) next to the sign-out button, looking like a leaked session token — fixed by
+  attaching Authentik's default openid/profile/email scope mappings, no app code change needed. Full
+  writeup in `docs/oidc-setup.md`. The Authentik blueprint is now version-controlled at
+  `deploy/authentik/homelab-monitor-oidc.yaml` (source of truth — previously only lived on CT121 via
+  ad-hoc `scp`/`pct push`); redeploy steps are in `docs/oidc-setup.md`.
 - **`e2e/`** (Playwright, done): drives a real browser against the **live** deployment, not a local dev
   server. `local-login.spec.ts` and `oidc-login.spec.ts` — the latter uses a dedicated Authentik test
   account (`playwright-test`, blueprint-provisioned, path `users/service-accounts`, never a real personal