diff --git a/AGENTS.md b/AGENTS.md
index c222f8c..a200818 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -52,7 +52,7 @@ cp config.env.example config.env   # populate with Connect API details
 ./prerequisites.sh                  # verify tooling and log in
 ```
 
-`config.env` must be populated before running any deployment script. It sets `CONNECT_URL`, `CONNECT_TRUST_DOMAIN`, `CONNECT_BUNDLE_HOST`, `AUTHORIZATION_DOMAIN`, `AUTHORIZATION_CLIENT_ID`, `NAMESPACE`, and `LOCAL`.
+`config.env` must be populated before running any deployment script. It sets `CONNECT_URL`, `CONNECT_TRUST_DOMAIN`, `CONNECT_BUNDLE_HOST`, `OAUTH_CLIENT_ID`, `NAMESPACE`, and `LOCAL`.
 
 ### Running deployments
 
diff --git a/workloads/config.env.example b/workloads/config.env.example
index b56b3e9..bf35d8a 100644
--- a/workloads/config.env.example
+++ b/workloads/config.env.example
@@ -4,10 +4,8 @@ CONNECT_URL="<connect host:port>"
 CONNECT_TRUST_DOMAIN="<connect trust domain>"
 # Bundle endpoint host of Connect API.
 CONNECT_BUNDLE_HOST="<connect bundle host>"
-# Domain of authorization provider.
-AUTHORIZATION_DOMAIN="<authz domain>"
 # Client ID for authorization.
-AUTHORIZATION_CLIENT_ID="<authz client ID>"
+OAUTH_CLIENT_ID="<authz client ID>"
 # Kubernetes namespace for validation workload.
 NAMESPACE=production
 # If the Kubernetes clusters are local (Kind).
diff --git a/workloads/federated-cofidectl-tf.sh b/workloads/federated-cofidectl-tf.sh
index a9f737d..1fd565d 100755
--- a/workloads/federated-cofidectl-tf.sh
+++ b/workloads/federated-cofidectl-tf.sh
@@ -60,8 +60,7 @@ cofidectl connect init \
   --connect-url $CONNECT_URL \
   --connect-trust-domain $CONNECT_TRUST_DOMAIN \
   --connect-bundle-host $CONNECT_BUNDLE_HOST \
-  --authorization-domain $AUTHORIZATION_DOMAIN \
-  --authorization-client-id $AUTHORIZATION_CLIENT_ID \
+  --oauth-client-id $OAUTH_CLIENT_ID \
   --use-join-token
 
 set +x
diff --git a/workloads/federated-cofidectl.sh b/workloads/federated-cofidectl.sh
index 5ac3670..eb4d734 100755
--- a/workloads/federated-cofidectl.sh
+++ b/workloads/federated-cofidectl.sh
@@ -51,8 +51,7 @@ cofidectl connect init \
   --connect-url $CONNECT_URL \
   --connect-trust-domain $CONNECT_TRUST_DOMAIN \
   --connect-bundle-host $CONNECT_BUNDLE_HOST \
-  --authorization-domain $AUTHORIZATION_DOMAIN \
-  --authorization-client-id $AUTHORIZATION_CLIENT_ID \
+  --oauth-client-id $OAUTH_CLIENT_ID \
   --use-join-token
 
 cofidectl trust-zone add \
diff --git a/workloads/federated-helm-tf-eks.sh b/workloads/federated-helm-tf-eks.sh
index 347c023..a89464d 100755
--- a/workloads/federated-helm-tf-eks.sh
+++ b/workloads/federated-helm-tf-eks.sh
@@ -92,8 +92,7 @@ cofidectl connect init \
   --connect-url $CONNECT_URL \
   --connect-trust-domain $CONNECT_TRUST_DOMAIN \
   --connect-bundle-host $CONNECT_BUNDLE_HOST \
-  --authorization-domain $AUTHORIZATION_DOMAIN \
-  --authorization-client-id $AUTHORIZATION_CLIENT_ID
+  --oauth-client-id $OAUTH_CLIENT_ID
 
 ## Deploy SPIRE components using Helm
 
diff --git a/workloads/login.sh b/workloads/login.sh
index f24b0fd..80da6c9 100755
--- a/workloads/login.sh
+++ b/workloads/login.sh
@@ -13,9 +13,7 @@ cofidectl connect init \
   --connect-url $CONNECT_URL \
   --connect-trust-domain $CONNECT_TRUST_DOMAIN \
   --connect-bundle-host $CONNECT_BUNDLE_HOST \
-  --authorization-domain $AUTHORIZATION_DOMAIN \
-  --authorization-client-id $AUTHORIZATION_CLIENT_ID \
-  --connect-datasource
+  --oauth-client-id $OAUTH_CLIENT_ID
 
 if ! cofidectl connect login --check; then
   cofidectl connect login
diff --git a/workloads/multi-mesh-cofidectl.sh b/workloads/multi-mesh-cofidectl.sh
index d1c3f39..5b9ce55 100755
--- a/workloads/multi-mesh-cofidectl.sh
+++ b/workloads/multi-mesh-cofidectl.sh
@@ -73,8 +73,7 @@ cofidectl connect init \
   --connect-url $CONNECT_URL \
   --connect-trust-domain $CONNECT_TRUST_DOMAIN \
   --connect-bundle-host $CONNECT_BUNDLE_HOST \
-  --authorization-domain $AUTHORIZATION_DOMAIN \
-  --authorization-client-id $AUTHORIZATION_CLIENT_ID \
+  --oauth-client-id $OAUTH_CLIENT_ID \
   --use-join-token
 
 cofidectl trust-zone add \
diff --git a/workloads/single-trust-zone-cofidectl-eks.sh b/workloads/single-trust-zone-cofidectl-eks.sh
index d6bae11..574bc72 100755
--- a/workloads/single-trust-zone-cofidectl-eks.sh
+++ b/workloads/single-trust-zone-cofidectl-eks.sh
@@ -29,8 +29,7 @@ cofidectl connect init \
   --connect-url $CONNECT_URL \
   --connect-trust-domain $CONNECT_TRUST_DOMAIN \
   --connect-bundle-host $CONNECT_BUNDLE_HOST \
-  --authorization-domain $AUTHORIZATION_DOMAIN \
-  --authorization-client-id $AUTHORIZATION_CLIENT_ID
+  --oauth-client-id $OAUTH_CLIENT_ID
 
 cofidectl trust-zone add \
   $WORKLOAD_TRUST_ZONE_1 \
diff --git a/workloads/single-trust-zone-cofidectl-tf.sh b/workloads/single-trust-zone-cofidectl-tf.sh
index 1800b27..0f0a022 100755
--- a/workloads/single-trust-zone-cofidectl-tf.sh
+++ b/workloads/single-trust-zone-cofidectl-tf.sh
@@ -42,8 +42,7 @@ cofidectl connect init \
   --connect-url $CONNECT_URL \
   --connect-trust-domain $CONNECT_TRUST_DOMAIN \
   --connect-bundle-host $CONNECT_BUNDLE_HOST \
-  --authorization-domain $AUTHORIZATION_DOMAIN \
-  --authorization-client-id $AUTHORIZATION_CLIENT_ID \
+  --oauth-client-id $OAUTH_CLIENT_ID \
   --use-join-token
 
 set +x
diff --git a/workloads/single-trust-zone-cofidectl.sh b/workloads/single-trust-zone-cofidectl.sh
index 34b56a3..97cd864 100755
--- a/workloads/single-trust-zone-cofidectl.sh
+++ b/workloads/single-trust-zone-cofidectl.sh
@@ -41,8 +41,7 @@ cofidectl connect init \
   --connect-url $CONNECT_URL \
   --connect-trust-domain $CONNECT_TRUST_DOMAIN \
   --connect-bundle-host $CONNECT_BUNDLE_HOST \
-  --authorization-domain $AUTHORIZATION_DOMAIN \
-  --authorization-client-id $AUTHORIZATION_CLIENT_ID \
+  --oauth-client-id $OAUTH_CLIENT_ID \
   --use-oss-spire
 
 cofidectl trust-zone add \