diff --git a/README.md b/README.md
index d7d7bb3..d34e151 100644
--- a/README.md
+++ b/README.md
@@ -40,7 +40,7 @@ Groups decide access. Each OIDC client names one group in `metadata.required_gro
 
 | Group | Grants |
 |---|---|
-| `infra-admins` | Mesh admin UIs (forward-auth), Coolify, the admin page |
+| `infra-admins` | Mesh admin UIs (forward-auth), Grafana, Flux web UI, the admin page |
 | `site-admins` | The bulbashenko.com admin panel |
 | `mail-users` | Mail clients and the Stalwart web UI |
 | `vpn-users` | Joining the VPN mesh (Headscale) |
@@ -72,7 +72,7 @@ The deploying side provides the namespace, the image tag and a Secret `auth` wit
    | `KRATOS_CIPHER_SECRET` | exactly 32 characters: `openssl rand -hex 16` |
    | `SMTP_CONNECTION_URI` | `smtps://noreply%40example.com:<url-encoded password>@host.docker.internal:465/?server_name=mail.example.com` |
    | `SMTP_SENDER` | `noreply@example.com` |
-   | `OIDC_SITE_CLIENT_SECRET`, `OIDC_COOLIFY_CLIENT_SECRET`, `OIDC_HEADSCALE_CLIENT_SECRET` | `scripts/new-client-secret.sh`; the app gets the same value |
+   | `OIDC_SITE_CLIENT_SECRET`, `OIDC_HEADSCALE_CLIENT_SECRET`, `OIDC_FLUXWEB_CLIENT_SECRET`, `OIDC_GRAFANA_CLIENT_SECRET` | `scripts/new-client-secret.sh`; the app gets the same value |
 
    Optional: `AUTH_LOG_LEVEL` (`info`), `AUTH_RATE_LIMIT_PER_CLIENT` (10 per minute), `AUTH_RATE_LIMIT_TOTAL` (120 per minute).
    For another domain, change the domains in `ory/*/*.yml`, `ory/hydra/clients/` and the defaults of `AUTH_HOST`, `AUTH_PUBLIC_URL` and `AUTH_ADMIN_HOST`.
diff --git a/compose.yml b/compose.yml
index 93d50b1..2ff79d2 100644
--- a/compose.yml
+++ b/compose.yml
@@ -263,7 +263,6 @@ services:
     environment:
       HYDRA_ADMIN_URL: http://hydra:4445
       OIDC_SITE_CLIENT_SECRET: ${OIDC_SITE_CLIENT_SECRET:?}
-      OIDC_COOLIFY_CLIENT_SECRET: ${OIDC_COOLIFY_CLIENT_SECRET:?}
       OIDC_HEADSCALE_CLIENT_SECRET: ${OIDC_HEADSCALE_CLIENT_SECRET:?}
       OIDC_FLUXWEB_CLIENT_SECRET: ${OIDC_FLUXWEB_CLIENT_SECRET:?}
       OIDC_GRAFANA_CLIENT_SECRET: ${OIDC_GRAFANA_CLIENT_SECRET:?}
diff --git a/deploy/k8s/ui.yaml b/deploy/k8s/ui.yaml
index 2171d9c..fb8c6ea 100644
--- a/deploy/k8s/ui.yaml
+++ b/deploy/k8s/ui.yaml
@@ -84,7 +84,6 @@ spec:
           env:
             - { name: HYDRA_ADMIN_URL, value: "http://hydra:4445" }
             - { name: OIDC_SITE_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_SITE_CLIENT_SECRET } } }
-            - { name: OIDC_COOLIFY_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_COOLIFY_CLIENT_SECRET } } }
             - { name: OIDC_HEADSCALE_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_HEADSCALE_CLIENT_SECRET } } }
             - { name: OIDC_FLUXWEB_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_FLUXWEB_CLIENT_SECRET } } }
             - { name: OIDC_GRAFANA_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_GRAFANA_CLIENT_SECRET } } }
diff --git a/e2e/test.env b/e2e/test.env
index c11c55b..2af421f 100644
--- a/e2e/test.env
+++ b/e2e/test.env
@@ -14,7 +14,6 @@ SERVICE_PASSWORD_64_HYDRAPAGINATION=test-hydra-pagination-secret-0123456789
 SMTP_CONNECTION_URI=smtp://mailpit:1025/?disable_starttls=true
 SMTP_SENDER=noreply@bulbashenko.test
 OIDC_SITE_CLIENT_SECRET=test-site-secret
-OIDC_COOLIFY_CLIENT_SECRET=test-coolify-secret
 OIDC_HEADSCALE_CLIENT_SECRET=test-headscale-secret
 OIDC_FLUXWEB_CLIENT_SECRET=test-fluxweb-secret
 OIDC_GRAFANA_CLIENT_SECRET=test-grafana-secret
diff --git a/kustomization.yaml b/kustomization.yaml
index 7209800..3f75eca 100644
--- a/kustomization.yaml
+++ b/kustomization.yaml
@@ -32,7 +32,6 @@ configMapGenerator:
   - name: hydra-clients
     files:
       - ory/hydra/clients/bulbashenko-site.json
-      - ory/hydra/clients/coolify.json
       - ory/hydra/clients/flux-web.json
       - ory/hydra/clients/grafana.json
       - ory/hydra/clients/headscale.json
diff --git a/ory/hydra/clients/coolify.json b/ory/hydra/clients/coolify.json
deleted file mode 100644
index 4b0444c..0000000
--- a/ory/hydra/clients/coolify.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "client_id": "coolify",
-  "client_name": "Coolify",
-  "client_secret": "${OIDC_COOLIFY_CLIENT_SECRET}",
-  "token_endpoint_auth_method": "client_secret_post",
-  "grant_types": ["authorization_code"],
-  "response_types": ["code"],
-  "scope": "openid profile email",
-  "redirect_uris": ["https://coolify.int.bulbashenko.com/auth/oidc/callback"],
-  "skip_consent": true,
-  "metadata": { "required_group": "infra-admins" }
-}