diff --git a/backend/Program.cs b/backend/Program.cs
index 0cf79c2..6c7bb27 100644
--- a/backend/Program.cs
+++ b/backend/Program.cs
@@ -20,6 +20,7 @@ builder.Services.AddAuthentication("Bearer")
     {
         options.Authority = builder.Configuration["Zitadel:Issuer"] ?? "https://auth.kuns.dev";
         options.Audience = builder.Configuration["Zitadel:ClientId"] ?? "";
+        options.MapInboundClaims = false; // Prevent .NET from remapping "sub" to long URI
         options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidateIssuer = true,