diff --git a/content/en/docs/next/operations/services/monitoring/oidc-authentication.md b/content/en/docs/next/operations/services/monitoring/oidc-authentication.md
index b0ee8b690..65f8df1ee 100644
--- a/content/en/docs/next/operations/services/monitoring/oidc-authentication.md
+++ b/content/en/docs/next/operations/services/monitoring/oidc-authentication.md
@@ -47,7 +47,7 @@ Cozystack provisions the following. Every derived identifier below uses `<releas
 - A per-instance **`KeycloakClient`** in the `cozy` realm with `clientId` set to `<namespace>-<release>` (for the CR above: `tenant-acme-monitoring-system`). Confidential (`clientAuthenticatorType: client-secret`), `secret` sourced from a chart-owned Kubernetes Secret. `redirectUris` locked to `https://grafana.<host>/login/generic_oauth`.
 - A per-instance **`KeycloakClientScope`** whose audience mapper pins the token's `aud` claim to that same `clientId` — the isolation primitive.
 - A persistent Kubernetes **Secret** carrying the confidential `client-secret` (random on first install, preserved on upgrades).
-- A chart-owned **users-reconcile Job** (`<release>-oidc-users`) that syncs `spec.oidc.users[]` into the Grafana instance on every reconcile: creates missing Grafana accounts, patches roles, and prunes stale org members. Runs as a post-install / post-upgrade hook when `users[]` is non-empty; omitted otherwise (BYO-IdP-friendly).
+- A chart-owned **post-install / post-upgrade Job** (`<release>-oidc-users`). In every mode it waits until Grafana's Deployment has rolled out the current spec and answers its health endpoint, so the Monitoring release reports Ready only once Grafana is serving. When `users[]` is non-empty it also syncs `spec.oidc.users[]` into the Grafana instance on every reconcile: creates missing Grafana accounts, patches roles, and prunes stale org members. With `users[]` empty it only checks readiness and leaves org membership alone (BYO-IdP-friendly).
 - An **`auth.generic_oauth`** entry under the Grafana CR's **`spec.config`** (a single ini-section key literally named `auth.generic_oauth`, so it is addressed as `spec.config["auth.generic_oauth"]`, not a two-level `auth` / `generic_oauth` nesting), wired to the platform realm issuer (`cozy` by default, set via `authentication.oidc.realmName`), per-instance audience scope, and the tenant-membership gate:
 
   ```ini
@@ -152,7 +152,7 @@ The `admin_user` / `admin_password` field on the form stays wired to `grafana-ad
 - **`groups_attribute_path` is not optional on Grafana v11.x+.** The chart wires it automatically for `System` mode; in `CustomConfig` inline the operator must add it explicitly (`groups_attribute_path: groups`) if their IdP emits a top-level `groups` array. Otherwise `allowed_groups` becomes a silent no-op and every login fails.
 - **BYO issuer with a self-signed CA.** In `CustomConfig` mode the `secretRef` path is the way to ship a CA bundle alongside the `[auth.generic_oauth]` block — you package `auth.ini` and any `ca-cert` files into the Secret and mount both under `/etc/grafana/oidc`. Placing the file is not enough on its own: point `tls_client_ca` at it from inside your `auth.ini` so Grafana actually trusts the issuer's certificate.
 - **`admin_user` stays a break-glass path.** Even under `mode: System` the login form and the `grafana-admin-password` Secret remain wired. Locking the form off is a follow-up hardening.
-- **Mode toggle is non-destructive.** The users-Job renders only when `spec.oidc.mode` is not `None` *and* `spec.oidc.users[]` is non-empty. Flipping `spec.oidc.mode` from `System` to `None` therefore runs no reconcile and no prune pass: the Grafana accounts the Job provisioned survive untouched, and OIDC login is simply no longer offered on the form. Flipping back to `System` resumes reconciliation of `spec.oidc.users[]` against those existing accounts.
+- **Mode toggle is non-destructive.** The Job reconciles users only when `spec.oidc.mode` is not `None` *and* `spec.oidc.users[]` is non-empty; otherwise it only waits for Grafana to be ready and mounts no admin credentials. Flipping `spec.oidc.mode` from `System` to `None` therefore runs no reconcile and no prune pass: the Grafana accounts the Job provisioned survive untouched, and OIDC login is simply no longer offered on the form. Flipping back to `System` resumes reconciliation of `spec.oidc.users[]` against those existing accounts.
 
 ## What's out of scope for this feature