diff --git a/docs/sso-and-identity.md b/docs/sso-and-identity.md
index 72a7bb8..edbd19e 100644
--- a/docs/sso-and-identity.md
+++ b/docs/sso-and-identity.md
@@ -23,6 +23,30 @@ Every app gets the Proxy Provider registration described above — that's the un
 | Seerr | [`stacks/media/seerr/`](../stacks/media/seerr/) |
 | Proxmox / PBS | hypervisor-level, not a docker stack — PBS has both layers, Proxmox has native OIDC only |
 
+This is the real list behind that table, not a transcription of it — every provider whose model type is genuinely `oauth2`, not just named the same as an app:
+
+```
+$ curl -s -H "Authorization: Bearer [REDACTED]" \
+  "https://authentik.[service-to-service zone]/api/v3/providers/all/?page_size=200" \
+  | python3 -c "
+import json,sys
+d = json.load(sys.stdin)
+for r in d['results']:
+    if r.get('component') == 'ak-provider-oauth2-form':
+        print(r.get('name'))
+" | sort
+audiobookshelf
+dockhand
+gitea
+grafana
+immich
+nextcloud
+paperless
+pbs
+proxmox
+seerr
+```
+
 Every other app runs on the Proxy Provider alone — which, per the point above, is never a weaker path: it's the same forward-auth check either way, just without a second, app-native login layered on top of it.
 
 This is the actual live query against Authentik's API, not a paraphrase of what's assumed to be configured: