diff --git a/FRESH-INSTALL.md b/FRESH-INSTALL.md
index 265eb03..a2b1c36 100644
--- a/FRESH-INSTALL.md
+++ b/FRESH-INSTALL.md
@@ -58,6 +58,8 @@ Log in at `https://auth.BASE/` as `akadmin` with `AUTHENTIK_BOOTSTRAP_PASSWORD`
 3. Flows & Stages → Stages → `default-source-enrollment-write` → User type **Internal**, user path `users`.
 4. Directory → Groups: `streamers`, `editors`, `media-admins`, `admins`, `bot-users`, `git-users`, `git-admins`.
    Nesting: `admins` parent `authentik Admins`; `authentik Admins` parent `git-admins` (admins inherit everything).
+   Inherited groups reach the apps only with the extra scope mapping `Vanguard profile (nested groups)` (README 5d),
+   ticked on the `Vanguard sites`, `Jellyfin` and `Gitea` providers next to the default profile mapping.
 5. Customization → Policies → Create Expression Policy ×2 from the repo:
    `discord-guild-member` (`authentik/discord-guild-policy.py`, set your server ID) and
    `discord-roles-to-groups` (`authentik/discord-roles-to-groups.py`, set server ID + role-id→group table).
@@ -204,6 +206,11 @@ F3. Flows & Stages → Stages → default-authentication-identification → Edit
 F4. Flows & Stages → Stages → default-source-enrollment-write → Edit → User type: Internal · User path: users → Update.
 F5. Directory → Groups → Create, one each: streamers, editors, media-admins, admins, bot-users, git-users, git-admins.
     Then nesting: Groups → admins → Edit → Parent: authentik Admins → Update. Groups → authentik Admins → Edit → Parent: git-admins → Update.
+F5b. Customization → Property Mappings → Create → Scope Mapping: Name `Vanguard profile (nested groups)`, Scope name `profile`, Expression:
+        direct = set(request.user.ak_groups.all())
+        return {"groups": sorted(g.name for g in request.user.all_groups() if g not in direct)}
+     → Finish. Later, on each provider created in F7–F9 (Vanguard sites, Jellyfin, Gitea) → Edit → Advanced protocol settings → Scopes: tick it
+     next to the default profile mapping (proxy providers re-add the default on save; that is fine, the two merge). Without it `/whoami` never shows git-admins.
 F6. Customization → Policies → Create → Expression Policy:
     name discord-guild-member · expression = contents of authentik/discord-guild-policy.py with ACCEPTED_GUILD_ID + GUILD_NAME filled in · tick Execution logging → Create.
     Again: name discord-roles-to-groups · expression = authentik/discord-roles-to-groups.py with GUILD_ID + ROLE_TO_GROUP filled from A3 · Execution logging → Create.
diff --git a/STATUS.md b/STATUS.md
index aba1f0c..e4b2191 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -72,7 +72,7 @@ Source of truth: this repo, `techy/Media-Server-Setup` on the stack's own Gitea
 
 0. **Hostname restructure deploy** (committed 2026-11-01): DNS CNAMEs `media`, `files`, `clips`, `sync`; `./configure.py --full` with `media.` as main; MediaMTX restart between streams; `./deployLive.sh`; streamers re-add the dock at `live./dock/` and redo "Add band + clock source"; re-pin Discord links. Procedure C in HOSTNAME-CHANGE.md.
 
-1. Roles→groups policy: bound and updated (revokes only its own grants); will be proven by the next natural Discord logins (`/whoami` should show `bot-users`, `git-admins`). `akadmin` remains the recovery login if a policy misfires.
+1. Roles→groups policy: bound and updated (revokes only its own grants); will be proven by the next natural Discord logins (`/whoami` should show `bot-users`). Nested groups **verified 2026-11-01**: `git-admins` now reaches the header via the `Vanguard profile (nested groups)` scope mapping (README 5d). `akadmin` remains the recovery login if a policy misfires.
 2. Confirm plugin 0.1.3 under Jellyfin → Plugins and the Gitea runner registered.
 3. Portal viewer during a real stream: corner chip `webrtc`; Windows Go Live with WarDogs audio (first Windows streamer).
 5. Housekeeping: pin `AUTHENTIK_TAG`, rotate the Discord client secret seen in a screenshot, nightly Postgres dump, Caddyfile formatting warning.