diff --git a/README.md b/README.md
index d4a9d37..8c69d41 100644
--- a/README.md
+++ b/README.md
@@ -271,7 +271,17 @@ Keep repo write access to trusted people.
    Auto Discovery URL `https://auth.HOST/application/o/gitea/.well-known/openid-configuration`, tick "Skip local
    2FA", claim name for groups `groups`, administrator group claim value **`git-admins`**. Save.
    Authentik group nesting makes the admins inherit it: `authentik Admins` → parent `admins` → parent `git-admins`
-   (members of a child group count as members of the parent, in the `groups` claim and in Caddy's header checks).
+   (members of a child group count as members of the parent). **Inherited groups are not in the `groups` claim by
+   default**: the managed profile mapping uses `ak_groups` (direct memberships only), and proxy providers re-add
+   that mapping on every save, so it cannot be swapped out. Add a second scope mapping, Customization → Property
+   Mappings → Create → Scope Mapping, name `Vanguard profile (nested groups)`, scope `profile`, expression:
+
+       direct = set(request.user.ak_groups.all())
+       return {"groups": sorted(g.name for g in request.user.all_groups() if g not in direct)}
+
+   and tick it (next to the default one) on the `Vanguard sites`, `Jellyfin` and `Gitea` providers → Advanced
+   protocol settings → Scopes. Claims from several mappings merge, so the header becomes direct + inherited groups
+   without duplicates. Takes effect on the next login.
 3. compose (already set): registration only via external sources, auto-registration + account linking on,
    username from `preferred_username`. A first Discord login creates the Gitea user with no form.
 4. Access = Authentik group **`git-users`**: Directory → Groups → create it (add a Discord role to it in the