diff --git a/src/core/auth/oidc.go b/src/core/auth/oidc.go
index c9c5875..4a834e5 100644
--- a/src/core/auth/oidc.go
+++ b/src/core/auth/oidc.go
@@ -195,17 +195,23 @@ func decodeJWTSub(token string) (string, error) {
 	}
 
 	var claims struct {
-		Sub string `json:"sub"`
+		Sub               string `json:"sub"`
+		PreferredUsername string `json:"preferred_username"`
 	}
 	if err := json.Unmarshal(payload, &claims); err != nil {
 		return "", fmt.Errorf("parse JWT claims: %w", err)
 	}
 
-	if claims.Sub == "" {
-		return "", fmt.Errorf("missing sub claim in id_token")
+	// Use preferred_username (actual username), fall back to sub (UUID)
+	username := claims.PreferredUsername
+	if username == "" {
+		username = claims.Sub
+	}
+	if username == "" {
+		return "", fmt.Errorf("missing username in id_token")
 	}
 
-	return claims.Sub, nil
+	return username, nil
 }
 
 // pkceChallenge creates a PKCE S256 challenge from a verifier.