diff --git a/src/Core/ZB.MOM.WW.OtOpcUa.Configuration/ServiceCollectionExtensions.cs b/src/Core/ZB.MOM.WW.OtOpcUa.Configuration/ServiceCollectionExtensions.cs
index 5685f1a4..658ac3af 100644
--- a/src/Core/ZB.MOM.WW.OtOpcUa.Configuration/ServiceCollectionExtensions.cs
+++ b/src/Core/ZB.MOM.WW.OtOpcUa.Configuration/ServiceCollectionExtensions.cs
@@ -1,6 +1,7 @@
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using ZB.MOM.WW.OtOpcUa.Configuration.Services;
 
 namespace ZB.MOM.WW.OtOpcUa.Configuration;
 
@@ -22,6 +23,16 @@ public static class ServiceCollectionExtensions
                 $"Connection string '{ConnectionStringName}' is required. Add it to appsettings.json or the OTOPCUA_CONFIG_CONNECTION env var.");
 
         services.AddDbContextFactory<OtOpcUaConfigDbContext>(opt => opt.UseSqlServer(connectionString));
+
+        // AddDbContextFactory registers only the IDbContextFactory<> — it does NOT also register
+        // a scoped OtOpcUaConfigDbContext. Config services that take the context directly (e.g.
+        // LdapGroupRoleMappingService) need a scoped instance, so bridge one off the factory.
+        services.AddScoped(sp => sp.GetRequiredService<IDbContextFactory<OtOpcUaConfigDbContext>>().CreateDbContext());
+
+        // Config-DB services consumed by both the AdminUI (RoleGrants page) and the auth/login
+        // host (AuthEndpoints.LoginAsync). Scoped to match the request/render scope of both callers.
+        services.AddScoped<ILdapGroupRoleMappingService, LdapGroupRoleMappingService>();
+
         return services;
     }
 }