diff --git a/conf/docker/.env.setup b/conf/docker/.env.setup
index 434c5b3..792abf1 100644
--- a/conf/docker/.env.setup
+++ b/conf/docker/.env.setup
@@ -158,8 +158,6 @@ MC_IAM_MANAGER_DEFAULT_WORKSPACE_NAME=ws01
 
 MC_IAM_MANAGER_AWS_STS_ENDPOINT=https://sts.amazonaws.com
 MC_IAM_MANAGER_AWS_ACCOUNT_ID=notyet
-MC_IAM_MANAGER_AWS_IDENTITY_PROVIDER_ARN=arn:aws:iam::${MC_IAM_MANAGER_AWS_ACCOUNT_ID}:oidc-provider/${MC_IAM_MANAGER_KEYCLOAK_DOMAIN}/realms/${MC_IAM_MANAGER_KEYCLOAK_OIDC_CLIENT_NAME}
-MC_IAM_MANAGER_AWS_IDENTITY_ROLE_ARN=arn:aws:iam::${MC_IAM_MANAGER_AWS_ACCOUNT_ID}:role/mciam-platformadmin
 
 
 MC_IAM_MANAGER_CSP_ROLE_PREFIX=mciam
@@ -172,6 +170,10 @@ MC_IAM_MANAGER_PUBLIC_DOMAIN=mciam.local
 MC_IAM_MANAGER_PUBLIC_HOST=https://${MC_IAM_MANAGER_PUBLIC_DOMAIN}
 MC_IAM_MANAGER_PUBLIC_KEYCLOAK_HOST=${MC_IAM_MANAGER_PUBLIC_HOST}/auth
 
+# === AWS IAM ARN (auto-composed from MC_IAM_MANAGER_PUBLIC_DOMAIN / MC_IAM_MANAGER_AWS_ACCOUNT_ID) ===
+MC_IAM_MANAGER_AWS_IDENTITY_PROVIDER_ARN=arn:aws:iam::${MC_IAM_MANAGER_AWS_ACCOUNT_ID}:oidc-provider/${MC_IAM_MANAGER_PUBLIC_DOMAIN}/auth/realms/${MC_IAM_MANAGER_KEYCLOAK_REALM}
+MC_IAM_MANAGER_AWS_IDENTITY_ROLE_ARN=arn:aws:iam::${MC_IAM_MANAGER_AWS_ACCOUNT_ID}:role/${MC_IAM_MANAGER_CSP_ROLE_PREFIX}-platformadmin
+
 # === nginx HTTPS Reverse Proxy Ports (for iframe/external access — same as direct published ports) ===
 MC_OBSERVABILITY_FRONT_PROXY_PORT=18081
 MC_OBSERVABILITY_FRONT_PUBLIC_HOST=https://${MC_IAM_MANAGER_PUBLIC_DOMAIN}:${MC_OBSERVABILITY_FRONT_PROXY_PORT}