diff --git a/Program.cs b/Program.cs
index 9321fab..b6ac86c 100644
--- a/Program.cs
+++ b/Program.cs
@@ -110,9 +110,14 @@ else
     .AddOpenIdConnect(options =>
     {
         var oidc = builder.Configuration.GetSection("Oidc");
-        options.Authority    = $"https://login.microsoftonline.com/{oidc["TenantId"]}/v2.0";
-        options.ClientId     = oidc["ClientId"];
-        options.ClientSecret = oidc["ClientSecret"];
+        // Strip accidental surrounding quotes/whitespace. docker-compose's `environment` list form
+        // (`- Oidc__TenantId="<guid>"`) embeds the literal quotes in the value, producing a malformed
+        // Authority (…/"<tenant>"/v2.0) that fails metadata discovery with IDX20803. Same trap on the
+        // secret would silently break the token exchange. Trim defensively.
+        static string Clean(string? v) => v?.Trim().Trim('"', '\'') ?? string.Empty;
+        options.Authority    = $"https://login.microsoftonline.com/{Clean(oidc["TenantId"])}/v2.0";
+        options.ClientId     = Clean(oidc["ClientId"]);
+        options.ClientSecret = Clean(oidc["ClientSecret"]);
         options.ResponseType = OpenIdConnectResponseType.Code;
         // Do NOT persist the OIDC access/id/refresh tokens in the auth cookie. They are
         // never read (SharePoint/Graph auth runs through the separate connect flow +