diff --git a/docs/toolhive/guides-k8s/auth-k8s.mdx b/docs/toolhive/guides-k8s/auth-k8s.mdx
index 5d1f1619..b7eb9657 100644
--- a/docs/toolhive/guides-k8s/auth-k8s.mdx
+++ b/docs/toolhive/guides-k8s/auth-k8s.mdx
@@ -112,7 +112,7 @@ spec:
   # highlight-start
   oidcConfigRef:
     name: production-oidc
-    audience: weather-server
+    audience: 'https://mcp.example.com/mcp'
     scopes:
       - openid
   # highlight-end
diff --git a/docs/toolhive/guides-k8s/connect-clients.mdx b/docs/toolhive/guides-k8s/connect-clients.mdx
index 9f32ad8a..a900fa62 100644
--- a/docs/toolhive/guides-k8s/connect-clients.mdx
+++ b/docs/toolhive/guides-k8s/connect-clients.mdx
@@ -240,13 +240,13 @@ spec:
   oidcConfigRef:
     name: my-oidc
     resourceUrl: https://mcp.example.com/<SERVER_NAME>/mcp
-    audience: my-audience
+    audience: https://mcp.example.com/<SERVER_NAME>/mcp
 ```
 
-The `audience` value should match the audience expected by your identity
-provider, and is likely the same for all servers using the same authorization
-server. See [Authentication and authorization](./auth-k8s.mdx) for full OIDC
-setup instructions.
+Set `audience` to match `resourceUrl`, the server's own canonical URL. Each
+server needs a unique audience so a token issued for one server can't be
+replayed against another. See [Authentication and authorization](./auth-k8s.mdx)
+for full OIDC setup instructions.
 
 Configure the Ingress with additional rules for the `.well-known` paths of each
 MCP server that has OAuth enabled:
@@ -498,13 +498,13 @@ spec:
   oidcConfigRef:
     name: my-oidc
     resourceUrl: https://mcp.example.com/<SERVER_NAME>/mcp
-    audience: my-audience
+    audience: https://mcp.example.com/<SERVER_NAME>/mcp
 ```
 
-The `audience` value should match the audience expected by your identity
-provider, and is likely the same for all servers using the same authorization
-server. See [Authentication and authorization](./auth-k8s.mdx) for full OIDC
-setup instructions.
+Set `audience` to match `resourceUrl`, the server's own canonical URL. Each
+server needs a unique audience so a token issued for one server can't be
+replayed against another. See [Authentication and authorization](./auth-k8s.mdx)
+for full OIDC setup instructions.
 
 Configure the HTTPRoute with additional rules for the `.well-known` paths of
 each MCP server that has OAuth enabled:
diff --git a/docs/toolhive/guides-k8s/rate-limiting.mdx b/docs/toolhive/guides-k8s/rate-limiting.mdx
index 0b4fcadb..375bd7d1 100644
--- a/docs/toolhive/guides-k8s/rate-limiting.mdx
+++ b/docs/toolhive/guides-k8s/rate-limiting.mdx
@@ -111,7 +111,7 @@ spec:
   transport: streamable-http
   oidcConfigRef:
     name: ratelimit-oidc
-    audience: my-audience
+    audience: https://mcp.example.com/mcp
   sessionStorage:
     provider: redis
     address: <YOUR_REDIS_ADDRESS>
@@ -151,7 +151,7 @@ spec:
   transport: streamable-http
   oidcConfigRef:
     name: ratelimit-oidc
-    audience: my-audience
+    audience: https://mcp.example.com/mcp
   sessionStorage:
     provider: redis
     address: <YOUR_REDIS_ADDRESS>
@@ -191,7 +191,7 @@ spec:
   transport: streamable-http
   oidcConfigRef:
     name: ratelimit-oidc
-    audience: my-audience
+    audience: https://mcp.example.com/mcp
   sessionStorage:
     provider: redis
     address: <YOUR_REDIS_ADDRESS>
@@ -317,7 +317,7 @@ spec:
     type: oidc
     oidcConfigRef:
       name: my-oidc-config
-      audience: shared-toolkit
+      audience: https://mcp.example.com/mcp
   sessionStorage:
     provider: redis
     address: <YOUR_REDIS_ADDRESS>
diff --git a/docs/toolhive/guides-k8s/remote-mcp-proxy.mdx b/docs/toolhive/guides-k8s/remote-mcp-proxy.mdx
index cebd54c5..8d341e6f 100644
--- a/docs/toolhive/guides-k8s/remote-mcp-proxy.mdx
+++ b/docs/toolhive/guides-k8s/remote-mcp-proxy.mdx
@@ -124,7 +124,7 @@ spec:
   oidcConfigRef:
     name: analytics-oidc
     # Expected audience claim in tokens
-    audience: analytics-mcp-proxy
+    audience: https://mcp.analytics.example.com
 
   # Authorization policies
   authzConfig:
@@ -233,7 +233,7 @@ spec:
   remoteUrl: https://mcp.example.com
   oidcConfigRef:
     name: company-oidc
-    audience: mcp-proxy
+    audience: https://mcp.example.com
 ```
 
 The proxy automatically discovers the JWKS URL from the issuer's OIDC discovery
@@ -480,7 +480,7 @@ spec:
 
   oidcConfigRef:
     name: analytics-oidc
-    audience: analytics-mcp-proxy
+    audience: https://mcp.analytics.example.com
 
   podTemplateSpec:
     spec:
@@ -683,7 +683,7 @@ spec:
   # For testing - use your IDP's configuration
   oidcConfigRef:
     name: test-oidc
-    audience: mcp-test
+    audience: https://modelcontextprotocol.io/mcp
 
   # Simple allow-all policy for testing
   authzConfig:
@@ -981,7 +981,7 @@ spec:
   proxyPort: 8080
   oidcConfigRef:
     name: company-oidc
-    audience: context7-proxy
+    audience: https://mcp.context7.com/mcp
 ```
 
 ### Benefits of vMCP aggregation
diff --git a/docs/toolhive/guides-vmcp/backend-discovery.mdx b/docs/toolhive/guides-vmcp/backend-discovery.mdx
index 85f7d997..bfa61770 100644
--- a/docs/toolhive/guides-vmcp/backend-discovery.mdx
+++ b/docs/toolhive/guides-vmcp/backend-discovery.mdx
@@ -467,7 +467,7 @@ spec:
     type: oidc
     oidcConfigRef:
       name: engineering-oidc
-      audience: engineering-vmcp
+      audience: https://mcp.engineering.example.com/mcp
   outgoingAuth:
     source: discovered # Discovers github-mcp and its auth config
 ```
diff --git a/docs/toolhive/guides-vmcp/configuration.mdx b/docs/toolhive/guides-vmcp/configuration.mdx
index b61f2794..f4d7fe74 100644
--- a/docs/toolhive/guides-vmcp/configuration.mdx
+++ b/docs/toolhive/guides-vmcp/configuration.mdx
@@ -73,7 +73,7 @@ spec:
   # Validate incoming requests
   oidcConfigRef:
     name: company-oidc
-    audience: context7-proxy
+    audience: https://mcp.context7.com/mcp
 ```
 
 :::note
@@ -326,7 +326,7 @@ spec:
     type: oidc
     oidcConfigRef:
       name: my-oidc-config
-      audience: my-vmcp
+      audience: https://mcp.example.com/mcp
   # highlight-start
   passthroughHeaders:
     - x-mcp-api-key
diff --git a/docs/toolhive/guides-vmcp/failure-handling.mdx b/docs/toolhive/guides-vmcp/failure-handling.mdx
index 593acff5..50da47b1 100644
--- a/docs/toolhive/guides-vmcp/failure-handling.mdx
+++ b/docs/toolhive/guides-vmcp/failure-handling.mdx
@@ -292,7 +292,7 @@ spec:
     type: oidc
     oidcConfigRef:
       name: my-issuer
-      audience: my-vmcp
+      audience: https://mcp.example.com/mcp
 ```
 
 ### Development with best effort
diff --git a/docs/toolhive/guides-vmcp/optimizer.mdx b/docs/toolhive/guides-vmcp/optimizer.mdx
index 1e49a5d3..9c98258c 100644
--- a/docs/toolhive/guides-vmcp/optimizer.mdx
+++ b/docs/toolhive/guides-vmcp/optimizer.mdx
@@ -440,8 +440,6 @@ spec:
     name: my-tools
   embeddingServerRef:
     name: full-embedding
-  groupRef:
-    name: my-tools
   config:
     optimizer:
       embeddingServiceTimeout: 15s
@@ -452,7 +450,7 @@ spec:
     type: oidc
     oidcConfigRef:
       name: my-oidc
-      audience: vmcp-example
+      audience: https://mcp.example.com/mcp
 ```
 
 ## Next steps