diff --git a/services/jellyfin/deployment.yaml b/services/jellyfin/deployment.yaml
index 53f79bc..961db93 100644
--- a/services/jellyfin/deployment.yaml
+++ b/services/jellyfin/deployment.yaml
@@ -94,28 +94,28 @@ spec:
                 "assemblies": []
               }
               EOF
-              IFS=',' read -ra scopes <<< "${OIDC_SCOPES}"
-              {
-                echo '<?xml version="1.0" encoding="utf-8"?>'
-                echo '<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">'
-                echo "  <OidEndpoint>${OIDC_ISSUER}</OidEndpoint>"
-                echo "  <OidClientId>${OIDC_CLIENT_ID}</OidClientId>"
-                echo "  <OidSecret>${OIDC_CLIENT_SECRET}</OidSecret>"
-                echo '  <OidScopes>'
-                for s in "${scopes[@]}"; do
-                  trimmed="$(echo "${s}" | xargs)"
-                  [ -z "${trimmed}" ] && continue
-                  echo "    <string>${trimmed}</string>"
-                done
-                echo '  </OidScopes>'
-                echo "  <RoleClaim>${OIDC_ROLE_CLAIM}</RoleClaim>"
-                echo "  <RedirectUri>${OIDC_REDIRECT_URI}</RedirectUri>"
-                echo "  <LogoutUri>${OIDC_LOGOUT_URI}</LogoutUri>"
-                echo '  <CertificatePath />'
-                echo '  <AutoCreateUser>true</AutoCreateUser>'
-                echo '  <AllowRememberMe>false</AllowRememberMe>'
-                echo '</PluginConfiguration>'
-              } >"${config_dir}/OIDC Authentication.xml"
+              scope_lines=""
+              for s in $(echo "${OIDC_SCOPES}" | tr ',' ' '); do
+                trimmed="$(echo "${s}" | xargs)"
+                [ -z "${trimmed}" ] && continue
+                scope_lines="${scope_lines}    <string>${trimmed}</string>\n"
+              done
+              cat >"${config_dir}/OIDC Authentication.xml" <<EOF
+              <?xml version="1.0" encoding="utf-8"?>
+              <PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+                <OidEndpoint>${OIDC_ISSUER}</OidEndpoint>
+                <OidClientId>${OIDC_CLIENT_ID}</OidClientId>
+                <OidSecret>${OIDC_CLIENT_SECRET}</OidSecret>
+                <OidScopes>
+              $(printf "%b" "${scope_lines}")  </OidScopes>
+                <RoleClaim>${OIDC_ROLE_CLAIM}</RoleClaim>
+                <RedirectUri>${OIDC_REDIRECT_URI}</RedirectUri>
+                <LogoutUri>${OIDC_LOGOUT_URI}</LogoutUri>
+                <CertificatePath />
+                <AutoCreateUser>true</AutoCreateUser>
+                <AllowRememberMe>false</AllowRememberMe>
+              </PluginConfiguration>
+              EOF
       runtimeClassName: nvidia
       containers:
         - name: jellyfin