diff --git a/hosts/marvin/services/shelfmark.nix b/hosts/marvin/services/shelfmark.nix
--- a/hosts/marvin/services/shelfmark.nix
+++ b/hosts/marvin/services/shelfmark.nix
@@ -1,9 +1,24 @@
 { self, config, ... }:
 let
-  d = self.lib.data.services.shelfmark;
+  d = self.data.services.shelfmark;
+  b = self.data.services.grimmory;
+  auth = self.data.auth;
   sec = config.age.secrets;
+  url = "https://${d.tsHost}.${self.data.tsNet}";
 in
 {
+  dish.oidcClients = [
+    {
+      clientId = d.oidcId;
+      displayName = "dishNet Shelfmark";
+      homepageUrl = url;
+      groups = [
+        "admins"
+      ];
+      clientSecretFile = ./secrets/shelfmark/oidc-secret.age;
+      redirectUrls = [ "${url}/api/auth/oidc/callback" ];
+    }
+  ];
   systemd.tmpfiles.settings = {
     "10-shelfmark" = {
       "/var/lib/shelfmark/config".d = {
@@ -27,7 +42,7 @@
       PGID = toString config.users.groups.booklore.gid;
 
       # General Config
-      CALIBRE_WEB_URL = "https://lib.pyrox.dev";
+      CALIBRE_WEB_URL = "https://${b.extUrl}";
       SEARCH_MODE = "direct";
       ONBOARDING = "false";
       USING_EXTERNAL_BYPASSER = "false";
@@ -36,8 +51,8 @@
       FILE_ORGANIZATION = "rename";
       # Auth
       AUTH_METHOD = "oidc";
-      OIDC_DISCOVERY_URL = "https://auth.pyrox.dev/.well-known/openid-configuration";
-      OIDC_CLIENT_ID = "b4e7e31f-e5f6-4fd3-9f8c-641a9dfde8b6";
+      OIDC_DISCOVERY_URL = auth.wk_url;
+      OIDC_CLIENT_ID = d.oidcId;
       OIDC_ADMIN_GROUP = "admins";
       HIDE_LOCAL_AUTH = "true";
       OIDC_AUTO_PROVISION = "true";
@@ -53,11 +68,7 @@
   };
 
   # tsnsrv sidecar
-  services.tsnsrv.services.shelfmark = {
-    urlParts = {
-      port = d.port;
-    };
-  };
+  services.tsnsrv.services.shelfmark.urlParts.port = d.port;
 
   age.secrets.shelfmark-secrets = {
     file = ./secrets/shelfmark/secrets.age;
diff --git a/hosts/marvin/services/secrets/shelfmark/secrets.age b/hosts/marvin/services/secrets/shelfmark/secrets.age
--- a/hosts/marvin/services/secrets/shelfmark/secrets.age
+++ b/hosts/marvin/services/secrets/shelfmark/secrets.age