diff --git a/scripts/authentik-setup.sh b/scripts/authentik-setup.sh
index d6e4429..8392c11 100644
--- a/scripts/authentik-setup.sh
+++ b/scripts/authentik-setup.sh
@@ -56,9 +56,13 @@ echo "   Authentik $VERSION"
 AUTHZ_FLOW=$(api GET "/flows/instances/?slug=default-provider-authorization-implicit-consent" | jget - "d['results'][0]['pk']")
 INVALIDATION_FLOW=$(api GET "/flows/instances/?slug=default-provider-invalidation-flow" | jget - "d['results'][0]['pk']" 2>/dev/null || echo "")
 
-SCOPES=$(api GET "/propertymappings/provider/scope/?managed__iexact=goauthentik.io/providers/oauth2/scope-openid" | jget - "d['results'][0]['pk']")
-for s in profile email; do
-  SCOPES="$SCOPES,$(api GET "/propertymappings/provider/scope/?managed__iexact=goauthentik.io/providers/oauth2/scope-$s" | jget - "d['results'][0]['pk']")"
+SCOPES=""
+for s in openid profile email; do
+  # NOTE: managed__iexact is silently ignored by this endpoint (returns the
+  # unfiltered list) - scope_name is the field that actually filters.
+  PK=$(api GET "/propertymappings/provider/scope/?scope_name=$s" | jget - "d['results'][0]['pk']")
+  [ -n "$PK" ] || { echo "   FATAL: no scope mapping found for scope_name=$s"; exit 1; }
+  SCOPES="${SCOPES:+$SCOPES,}$PK"
 done
 SCOPES_JSON=$(python3 -c "import sys;print(__import__('json').dumps(sys.argv[1].split(',')))" "$SCOPES")