diff --git a/roles/sys-svc-container/templates/onion_oidc_socks.yml.j2 b/roles/sys-svc-container/templates/onion_oidc_socks.yml.j2
index 5924a9016e..58ec9828f5 100644
--- a/roles/sys-svc-container/templates/onion_oidc_socks.yml.j2
+++ b/roles/sys-svc-container/templates/onion_oidc_socks.yml.j2
@@ -1,5 +1,6 @@
-{% set _oidc_onion_host = lookup('domain', 'web-app-keycloak') %}
+{% set _oidc_onion_host = lookup('tls', 'web-app-keycloak', 'domain') %}
 {% if (lookup('config', application_id, 'services.sso.enabled') | bool) and (_oidc_onion_host is search('\.onion$')) %}
     extra_hosts:
       - "host.docker.internal:host-gateway"
+      - "{{ _oidc_onion_host }}:host-gateway"
 {% endif %}
diff --git a/roles/web-app-matrix/templates/flavor/compose/services.yml.j2 b/roles/web-app-matrix/templates/flavor/compose/services.yml.j2
index 95fcf1b91d..230355bfa6 100644
--- a/roles/web-app-matrix/templates/flavor/compose/services.yml.j2
+++ b/roles/web-app-matrix/templates/flavor/compose/services.yml.j2
@@ -17,6 +17,7 @@
       - SYNAPSE_REPORT_STATS=no
     ports:
       - "{{ DOCKER_BIND_HOST }}:{{lookup('config', 'web-app-matrix', 'services.synapse.ports.local.http')}}:{{ container_port }}"
+{% include 'roles/sys-svc-container/templates/onion_oidc_socks.yml.j2' %}
 {% include 'roles/sys-svc-container/templates/healthcheck/curl.yml.j2' %}
 {{ lookup('container_depends_on', application_id) }}
 {% include 'roles/sys-svc-container/templates/networks.yml.j2' %}
diff --git a/roles/web-app-matrix/templates/flavor/compose/synapse/homeserver.yaml.j2 b/roles/web-app-matrix/templates/flavor/compose/synapse/homeserver.yaml.j2
index f049287c23..0386165b60 100644
--- a/roles/web-app-matrix/templates/flavor/compose/synapse/homeserver.yaml.j2
+++ b/roles/web-app-matrix/templates/flavor/compose/synapse/homeserver.yaml.j2
@@ -61,6 +61,9 @@ oidc_providers:
   - idp_id:         keycloak
     idp_name:       "{{ OIDC.BUTTON_TEXT }}"
     issuer:         "{{ OIDC.CLIENT.ISSUER_URL }}"
+{% if MATRIX_OIDC_HOST_IS_ONION | bool %}
+    skip_verification: true
+{% endif %}
     client_id:      "{{ OIDC.CLIENT.ID }}"
     client_secret:  "{{ OIDC.CLIENT.SECRET }}"
     scopes: ["openid", "profile"]
diff --git a/roles/web-app-peertube/templates/compose.yml.j2 b/roles/web-app-peertube/templates/compose.yml.j2
index ccf4bc1e3b..cc94985752 100644
--- a/roles/web-app-peertube/templates/compose.yml.j2
+++ b/roles/web-app-peertube/templates/compose.yml.j2
@@ -5,6 +5,7 @@
     image: {{ PEERTUBE_IMAGE }}:{{ PEERTUBE_VERSION }}
     container_name: {{ PEERTUBE_CONTAINER }}
 {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
+{% include 'roles/sys-svc-container/templates/onion_oidc_socks.yml.j2' %}
     ports:
      - "1935:1935"  # @todo Add to ports
      - "{{ DOCKER_BIND_HOST }}:{{ lookup('config', application_id, 'services.peertube.ports.local.http') }}:{{ container_port }}" 
diff --git a/roles/web-app-penpot/files/playwright/_shared.js b/roles/web-app-penpot/files/playwright/_shared.js
index c782d8ad41..1ad281a9ea 100644
--- a/roles/web-app-penpot/files/playwright/_shared.js
+++ b/roles/web-app-penpot/files/playwright/_shared.js
@@ -37,10 +37,12 @@ const env = {
 const loginRoute = (base) => `${base.replace(/\/$/, "")}/#/auth/login`;
 
 async function assertAuthenticated(page) {
-  // Leaving /auth/login proves a real session (dashboard/onboarding renders).
   await expect
     .poll(() => page.url(), { timeout: resolveTimeout(60_000), message: "expected to leave the login route after sign-in" })
     .not.toContain("/auth/login");
+  await expect
+    .poll(() => page.url(), { timeout: resolveTimeout(60_000), message: "expected the SPA to reach a #/ route after sign-in" })
+    .toContain("#/");
   await expect(page.locator("body")).toBeVisible({ timeout: resolveTimeout(60_000) });
 }
 
diff --git a/roles/web-app-penpot/templates/compose.yml.j2 b/roles/web-app-penpot/templates/compose.yml.j2
index f461f563ca..86f2635c6b 100644
--- a/roles/web-app-penpot/templates/compose.yml.j2
+++ b/roles/web-app-penpot/templates/compose.yml.j2
@@ -22,6 +22,7 @@
   {{ PENPOT_BACKEND_SERVICE }}:
 {% set service_name = PENPOT_BACKEND_SERVICE %}
 {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
+{% include 'roles/sys-svc-container/templates/onion_oidc_socks.yml.j2' %}
     image: "{{ PENPOT_BACKEND_IMAGE }}:{{ PENPOT_VERSION }}"
     container_name: {{ PENPOT_BACKEND_CONTAINER }}
 {% if (TLS_MODE | lower) == 'self_signed' %}