diff --git a/backend/go.mod b/backend/go.mod
index 7d921f0d..8f12b127 100644
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -233,4 +233,4 @@ require (
 	modernc.org/memory v1.11.0 // indirect
 )
 
-replace github.com/ory/fosite => github.com/pocket-id/fosite v1.2.0
+replace github.com/ory/fosite => github.com/pocket-id/fosite v1.3.0
diff --git a/backend/go.sum b/backend/go.sum
index 9387b711..332aea4b 100644
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -400,8 +400,8 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pocket-id/fosite v1.2.0 h1:Tk0ZIIChuyD8yprlYr95FMZsd0yq64FHj47sxkM2cQI=
-github.com/pocket-id/fosite v1.2.0/go.mod h1:v0FwUcx6Xd7xu/V6hLbIqtFfqRSWcJRJl1f8t0cnIuU=
+github.com/pocket-id/fosite v1.3.0 h1:lHs3bYhK3Xo7bKYcxSfNWN4hmSLO4gSLsQwwtl4oA0M=
+github.com/pocket-id/fosite v1.3.0/go.mod h1:v0FwUcx6Xd7xu/V6hLbIqtFfqRSWcJRJl1f8t0cnIuU=
 github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
 github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
diff --git a/backend/internal/oidc/authorization_handler.go b/backend/internal/oidc/authorization_handler.go
index e2d46efc..eb155991 100644
--- a/backend/internal/oidc/authorization_handler.go
+++ b/backend/internal/oidc/authorization_handler.go
@@ -21,18 +21,15 @@ const parRequestURIPrefix = "urn:ietf:params:oauth:request_uri:"
 type authorizationHandler struct {
 	provider             fosite.OAuth2Provider
 	authorizationService *authorizationService
-	baseURL              string
 }
 
 func newAuthorizationHandler(
 	provider fosite.OAuth2Provider,
 	authorizationService *authorizationService,
-	baseURL string,
 ) *authorizationHandler {
 	return &authorizationHandler{
 		provider:             provider,
 		authorizationService: authorizationService,
-		baseURL:              baseURL,
 	}
 }
 
@@ -99,8 +96,6 @@ func (h *authorizationHandler) authorize(c *gin.Context) {
 		return
 	}
 
-	response.AddParameter("iss", h.baseURL)
-
 	// fosite renders an auto-submitting HTML page for response_mode=form_post, which needs a relaxed CSP
 	h.relaxCSPForFormPost(c, ar)
 
diff --git a/backend/internal/oidc/module.go b/backend/internal/oidc/module.go
index 8703a837..cce7c5ed 100644
--- a/backend/internal/oidc/module.go
+++ b/backend/internal/oidc/module.go
@@ -101,7 +101,7 @@ func New(ctx context.Context, deps Dependencies) (*Module, error) {
 		store:        store,
 		cimdResolver: cimdResolver,
 
-		authorizationHandler: newAuthorizationHandler(provider, authorizationService, deps.Config.BaseURL),
+		authorizationHandler: newAuthorizationHandler(provider, authorizationService),
 		tokenHandler:         newTokenHandler(provider, claimsService, deps.APIAccess),
 		userInfoHandler:      newUserInfoHandler(provider, claimsService, deps.Config.BaseURL),
 		parHandler:           newPARHandler(provider),
diff --git a/backend/internal/oidc/provider.go b/backend/internal/oidc/provider.go
index 86049670..34653f46 100644
--- a/backend/internal/oidc/provider.go
+++ b/backend/internal/oidc/provider.go
@@ -43,6 +43,7 @@ func newProvider(store *Store, authenticator *federatedClientAuthenticator, sign
 		PushedAuthorizeContextLifespan:          90 * time.Second,
 		IDTokenIssuer:                           config.BaseURL,
 		AccessTokenIssuer:                       config.BaseURL,
+		AuthorizationResponseIssuer:             config.BaseURL,
 		TokenURL:                                config.TokenBaseURL + "/api/oidc/token",
 		ScopeStrategy:                           fosite.ExactScopeStrategy,
 		IgnoreUnknownScopes:                     true,