diff --git a/ak-platform/src/generated/sys_auth_apple/sys_auth_apple.rs b/ak-platform/src/generated/sys_auth_apple/sys_auth_apple.rs
index 9031f476f..0f37cf27c 100644
--- a/ak-platform/src/generated/sys_auth_apple/sys_auth_apple.rs
+++ b/ak-platform/src/generated/sys_auth_apple/sys_auth_apple.rs
@@ -41,6 +41,8 @@ pub struct RegisterDeviceResponse {
     pub nonce_endpoint: ::prost::alloc::string::String,
     #[prost(string, tag="7")]
     pub device_token: ::prost::alloc::string::String,
+    #[prost(string, tag="8")]
+    pub authorization_endpoint: ::prost::alloc::string::String,
 }
 include!("sys_auth_apple.tonic.rs");
 include!("sys_auth_apple.serde.rs");
diff --git a/ak-platform/src/generated/sys_auth_apple/sys_auth_apple.serde.rs b/ak-platform/src/generated/sys_auth_apple/sys_auth_apple.serde.rs
index 3c23d56e9..ba9c4e4dd 100644
--- a/ak-platform/src/generated/sys_auth_apple/sys_auth_apple.serde.rs
+++ b/ak-platform/src/generated/sys_auth_apple/sys_auth_apple.serde.rs
@@ -174,6 +174,9 @@ impl serde::Serialize for RegisterDeviceResponse {
         if !self.device_token.is_empty() {
             len += 1;
         }
+        if !self.authorization_endpoint.is_empty() {
+            len += 1;
+        }
         let mut struct_ser = serializer.serialize_struct("sys_auth_apple.RegisterDeviceResponse", len)?;
         if !self.client_id.is_empty() {
             struct_ser.serialize_field("clientId", &self.client_id)?;
@@ -196,6 +199,9 @@ impl serde::Serialize for RegisterDeviceResponse {
         if !self.device_token.is_empty() {
             struct_ser.serialize_field("deviceToken", &self.device_token)?;
         }
+        if !self.authorization_endpoint.is_empty() {
+            struct_ser.serialize_field("authorizationEndpoint", &self.authorization_endpoint)?;
+        }
         struct_ser.end()
     }
 }
@@ -218,6 +224,8 @@ impl<'de> serde::Deserialize<'de> for RegisterDeviceResponse {
             "nonceEndpoint",
             "device_token",
             "deviceToken",
+            "authorization_endpoint",
+            "authorizationEndpoint",
         ];
 
         #[allow(clippy::enum_variant_names)]
@@ -229,6 +237,7 @@ impl<'de> serde::Deserialize<'de> for RegisterDeviceResponse {
             Audience,
             NonceEndpoint,
             DeviceToken,
+            AuthorizationEndpoint,
         }
         impl<'de> serde::Deserialize<'de> for GeneratedField {
             fn deserialize<D>(deserializer: D) -> std::result::Result<GeneratedField, D::Error>
@@ -257,6 +266,7 @@ impl<'de> serde::Deserialize<'de> for RegisterDeviceResponse {
                             "audience" => Ok(GeneratedField::Audience),
                             "nonceEndpoint" | "nonce_endpoint" => Ok(GeneratedField::NonceEndpoint),
                             "deviceToken" | "device_token" => Ok(GeneratedField::DeviceToken),
+                            "authorizationEndpoint" | "authorization_endpoint" => Ok(GeneratedField::AuthorizationEndpoint),
                             _ => Err(serde::de::Error::unknown_field(value, FIELDS)),
                         }
                     }
@@ -283,6 +293,7 @@ impl<'de> serde::Deserialize<'de> for RegisterDeviceResponse {
                 let mut audience__ = None;
                 let mut nonce_endpoint__ = None;
                 let mut device_token__ = None;
+                let mut authorization_endpoint__ = None;
                 while let Some(k) = map_.next_key()? {
                     match k {
                         GeneratedField::ClientId => {
@@ -327,6 +338,12 @@ impl<'de> serde::Deserialize<'de> for RegisterDeviceResponse {
                             }
                             device_token__ = Some(map_.next_value()?);
                         }
+                        GeneratedField::AuthorizationEndpoint => {
+                            if authorization_endpoint__.is_some() {
+                                return Err(serde::de::Error::duplicate_field("authorizationEndpoint"));
+                            }
+                            authorization_endpoint__ = Some(map_.next_value()?);
+                        }
                     }
                 }
                 Ok(RegisterDeviceResponse {
@@ -337,6 +354,7 @@ impl<'de> serde::Deserialize<'de> for RegisterDeviceResponse {
                     audience: audience__.unwrap_or_default(),
                     nonce_endpoint: nonce_endpoint__.unwrap_or_default(),
                     device_token: device_token__.unwrap_or_default(),
+                    authorization_endpoint: authorization_endpoint__.unwrap_or_default(),
                 })
             }
         }
diff --git a/ee/psso/Bridge/Generated/sys_auth_apple.pb.swift b/ee/psso/Bridge/Generated/sys_auth_apple.pb.swift
index 355bf4caa..72c4c6ce2 100644
--- a/ee/psso/Bridge/Generated/sys_auth_apple.pb.swift
+++ b/ee/psso/Bridge/Generated/sys_auth_apple.pb.swift
@@ -85,6 +85,8 @@ nonisolated struct RegisterDeviceResponse: Sendable {
 
   var deviceToken: String = String()
 
+  var authorizationEndpoint: String = String()
+
   var unknownFields = SwiftProtobuf.UnknownStorage()
 
   init() {}
@@ -211,7 +213,7 @@ nonisolated extension RegisterDeviceRequest: SwiftProtobuf.Message, SwiftProtobu
 
 nonisolated extension RegisterDeviceResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
   static let protoMessageName: String = _protobuf_package + ".RegisterDeviceResponse"
-  static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{3}client_id\0\u{1}issuer\0\u{3}token_endpoint\0\u{3}jwks_endpoint\0\u{1}audience\0\u{3}nonce_endpoint\0\u{3}device_token\0")
+  static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{3}client_id\0\u{1}issuer\0\u{3}token_endpoint\0\u{3}jwks_endpoint\0\u{1}audience\0\u{3}nonce_endpoint\0\u{3}device_token\0\u{3}authorization_endpoint\0")
 
   mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
     while let fieldNumber = try decoder.nextFieldNumber() {
@@ -226,6 +228,7 @@ nonisolated extension RegisterDeviceResponse: SwiftProtobuf.Message, SwiftProtob
       case 5: try { try decoder.decodeSingularStringField(value: &self.audience) }()
       case 6: try { try decoder.decodeSingularStringField(value: &self.nonceEndpoint) }()
       case 7: try { try decoder.decodeSingularStringField(value: &self.deviceToken) }()
+      case 8: try { try decoder.decodeSingularStringField(value: &self.authorizationEndpoint) }()
       default: break
       }
     }
@@ -253,6 +256,9 @@ nonisolated extension RegisterDeviceResponse: SwiftProtobuf.Message, SwiftProtob
     if !self.deviceToken.isEmpty {
       try visitor.visitSingularStringField(value: self.deviceToken, fieldNumber: 7)
     }
+    if !self.authorizationEndpoint.isEmpty {
+      try visitor.visitSingularStringField(value: self.authorizationEndpoint, fieldNumber: 8)
+    }
     try unknownFields.traverse(visitor: &visitor)
   }
 
@@ -264,6 +270,7 @@ nonisolated extension RegisterDeviceResponse: SwiftProtobuf.Message, SwiftProtob
     if lhs.audience != rhs.audience {return false}
     if lhs.nonceEndpoint != rhs.nonceEndpoint {return false}
     if lhs.deviceToken != rhs.deviceToken {return false}
+    if lhs.authorizationEndpoint != rhs.authorizationEndpoint {return false}
     if lhs.unknownFields != rhs.unknownFields {return false}
     return true
   }
diff --git a/ee/psso/Bridge/SysdBridge.swift b/ee/psso/Bridge/SysdBridge.swift
index 24e264698..e88580359 100644
--- a/ee/psso/Bridge/SysdBridge.swift
+++ b/ee/psso/Bridge/SysdBridge.swift
@@ -182,7 +182,7 @@ public class SysdBridge {
                         }
                     ))
                 return ASAuthorizationProviderExtensionUserLoginConfiguration(
-                    loginUserName: reply.username
+                    loginUserName: reply.username,
                 )
             }
         }
@@ -211,6 +211,9 @@ public class SysdBridge {
                     jwksEndpointURL: URL(string: res.jwksEndpoint)!,
                     audience: res.audience
                 )
+                if #available(macOS 27.0, *) {
+                    cfg.authorizationURL = URL(string: res.authorizationEndpoint)!
+                }
                 cfg.nonceEndpointURL = URL(string: res.nonceEndpoint)!
                 cfg.customNonceRequestValues
                     .append(
diff --git a/ee/psso/authentikPlatform.xcodeproj/project.pbxproj b/ee/psso/authentikPlatform.xcodeproj/project.pbxproj
index 4e3c94922..7e0ae58d9 100644
--- a/ee/psso/authentikPlatform.xcodeproj/project.pbxproj
+++ b/ee/psso/authentikPlatform.xcodeproj/project.pbxproj
@@ -533,7 +533,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MACOSX_DEPLOYMENT_TARGET = "$(RECOMMENDED_MACOSX_DEPLOYMENT_TARGET)";
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				ONLY_ACTIVE_ARCH = YES;
@@ -592,7 +592,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MACOSX_DEPLOYMENT_TARGET = "$(RECOMMENDED_MACOSX_DEPLOYMENT_TARGET)";
 				MTL_ENABLE_DEBUG_INFO = NO;
 				MTL_FAST_MATH = YES;
 				SDKROOT = macosx;
diff --git a/pkg/agent_system/auth/apple.go b/pkg/agent_system/auth/apple.go
index e9db9ee87..c24773128 100644
--- a/pkg/agent_system/auth/apple.go
+++ b/pkg/agent_system/auth/apple.go
@@ -2,6 +2,7 @@ package auth
 
 import (
 	"context"
+	"fmt"
 
 	"goauthentik.io/api/v3"
 	"goauthentik.io/platform/pkg/ak"
@@ -43,12 +44,13 @@ func (auth *Server) RegisterDevice(ctx context.Context, req *pb.RegisterDeviceRe
 		return nil, err
 	}
 	return &pb.RegisterDeviceResponse{
-		ClientId:      d.ClientId,
-		Issuer:        d.Issuer,
-		TokenEndpoint: d.TokenEndpoint,
-		JwksEndpoint:  d.JwksEndpoint,
-		Audience:      d.Audience,
-		NonceEndpoint: d.NonceEndpoint,
-		DeviceToken:   dom.Token,
+		ClientId:              d.ClientId,
+		Issuer:                d.Issuer,
+		TokenEndpoint:         d.TokenEndpoint,
+		JwksEndpoint:          d.JwksEndpoint,
+		Audience:              d.Audience,
+		NonceEndpoint:         d.NonceEndpoint,
+		DeviceToken:           dom.Token,
+		AuthorizationEndpoint: fmt.Sprintf("%s/application/o/authorize/", dom.AuthentikURL),
 	}, nil
 }
diff --git a/pkg/agent_system/cli/troubleshoot_inspect.go b/pkg/agent_system/cli/troubleshoot_inspect.go
index 3ee4b6df3..37d978b51 100644
--- a/pkg/agent_system/cli/troubleshoot_inspect.go
+++ b/pkg/agent_system/cli/troubleshoot_inspect.go
@@ -20,12 +20,16 @@ var troubleshootInspectCmd = &cobra.Command{
 		if err != nil {
 			return errors.Wrap(err, "failed to connect to ctrl")
 		}
+		dc, err := client.NewDefault()
+		if err != nil {
+			return errors.Wrap(err, "failed to connect to default")
+		}
 
 		r, err := sc.TroubleshootInspect(cmd.Context(), &emptypb.Empty{})
 		if err != nil {
 			return err
 		}
-		cap, err := sc.Capabilities(cmd.Context(), &emptypb.Empty{})
+		cap, err := dc.Capabilities(cmd.Context(), &emptypb.Empty{})
 		if err != nil {
 			return err
 		}
diff --git a/pkg/pb/sys_auth_apple.pb.go b/pkg/pb/sys_auth_apple.pb.go
index 1220d5dc4..b98428c4a 100644
--- a/pkg/pb/sys_auth_apple.pb.go
+++ b/pkg/pb/sys_auth_apple.pb.go
@@ -194,16 +194,17 @@ func (x *RegisterDeviceRequest) GetSignKeyId() string {
 }
 
 type RegisterDeviceResponse struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	ClientId      string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
-	Issuer        string                 `protobuf:"bytes,2,opt,name=issuer,proto3" json:"issuer,omitempty"`
-	TokenEndpoint string                 `protobuf:"bytes,3,opt,name=token_endpoint,json=tokenEndpoint,proto3" json:"token_endpoint,omitempty"`
-	JwksEndpoint  string                 `protobuf:"bytes,4,opt,name=jwks_endpoint,json=jwksEndpoint,proto3" json:"jwks_endpoint,omitempty"`
-	Audience      string                 `protobuf:"bytes,5,opt,name=audience,proto3" json:"audience,omitempty"`
-	NonceEndpoint string                 `protobuf:"bytes,6,opt,name=nonce_endpoint,json=nonceEndpoint,proto3" json:"nonce_endpoint,omitempty"`
-	DeviceToken   string                 `protobuf:"bytes,7,opt,name=device_token,json=deviceToken,proto3" json:"device_token,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	state                 protoimpl.MessageState `protogen:"open.v1"`
+	ClientId              string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	Issuer                string                 `protobuf:"bytes,2,opt,name=issuer,proto3" json:"issuer,omitempty"`
+	TokenEndpoint         string                 `protobuf:"bytes,3,opt,name=token_endpoint,json=tokenEndpoint,proto3" json:"token_endpoint,omitempty"`
+	JwksEndpoint          string                 `protobuf:"bytes,4,opt,name=jwks_endpoint,json=jwksEndpoint,proto3" json:"jwks_endpoint,omitempty"`
+	Audience              string                 `protobuf:"bytes,5,opt,name=audience,proto3" json:"audience,omitempty"`
+	NonceEndpoint         string                 `protobuf:"bytes,6,opt,name=nonce_endpoint,json=nonceEndpoint,proto3" json:"nonce_endpoint,omitempty"`
+	DeviceToken           string                 `protobuf:"bytes,7,opt,name=device_token,json=deviceToken,proto3" json:"device_token,omitempty"`
+	AuthorizationEndpoint string                 `protobuf:"bytes,8,opt,name=authorization_endpoint,json=authorizationEndpoint,proto3" json:"authorization_endpoint,omitempty"`
+	unknownFields         protoimpl.UnknownFields
+	sizeCache             protoimpl.SizeCache
 }
 
 func (x *RegisterDeviceResponse) Reset() {
@@ -285,6 +286,13 @@ func (x *RegisterDeviceResponse) GetDeviceToken() string {
 	return ""
 }
 
+func (x *RegisterDeviceResponse) GetAuthorizationEndpoint() string {
+	if x != nil {
+		return x.AuthorizationEndpoint
+	}
+	return ""
+}
+
 var File_sys_auth_apple_proto protoreflect.FileDescriptor
 
 const file_sys_auth_apple_proto_rawDesc = "" +
@@ -301,7 +309,7 @@ const file_sys_auth_apple_proto_rawDesc = "" +
 	"\x15device_encryption_key\x18\x02 \x01(\tR\x13deviceEncryptionKey\x12\x1c\n" +
 	"\n" +
 	"enc_key_id\x18\x03 \x01(\tR\bencKeyId\x12\x1e\n" +
-	"\vsign_key_id\x18\x04 \x01(\tR\tsignKeyId\"\xff\x01\n" +
+	"\vsign_key_id\x18\x04 \x01(\tR\tsignKeyId\"\xb6\x02\n" +
 	"\x16RegisterDeviceResponse\x12\x1b\n" +
 	"\tclient_id\x18\x01 \x01(\tR\bclientId\x12\x16\n" +
 	"\x06issuer\x18\x02 \x01(\tR\x06issuer\x12%\n" +
@@ -309,7 +317,8 @@ const file_sys_auth_apple_proto_rawDesc = "" +
 	"\rjwks_endpoint\x18\x04 \x01(\tR\fjwksEndpoint\x12\x1a\n" +
 	"\baudience\x18\x05 \x01(\tR\baudience\x12%\n" +
 	"\x0enonce_endpoint\x18\x06 \x01(\tR\rnonceEndpoint\x12!\n" +
-	"\fdevice_token\x18\a \x01(\tR\vdeviceToken2\xcd\x01\n" +
+	"\fdevice_token\x18\a \x01(\tR\vdeviceToken\x125\n" +
+	"\x16authorization_endpoint\x18\b \x01(\tR\x15authorizationEndpoint2\xcd\x01\n" +
 	"\x0fSystemAuthApple\x12Y\n" +
 	"\fRegisterUser\x12#.sys_auth_apple.RegisterUserRequest\x1a$.sys_auth_apple.RegisterUserResponse\x12_\n" +
 	"\x0eRegisterDevice\x12%.sys_auth_apple.RegisterDeviceRequest\x1a&.sys_auth_apple.RegisterDeviceResponseB\vZ\x06pkg/pb\xba\x02\x00b\x06proto3"
diff --git a/protobuf/sys_auth_apple.proto b/protobuf/sys_auth_apple.proto
index 6d53f6359..5164f62aa 100644
--- a/protobuf/sys_auth_apple.proto
+++ b/protobuf/sys_auth_apple.proto
@@ -34,4 +34,5 @@ message RegisterDeviceResponse {
   string audience = 5;
   string nonce_endpoint = 6;
   string device_token = 7;
+  string authorization_endpoint = 8;
 }