diff --git a/services/authelia.sh b/services/authelia.sh
index e5de7b9..3d0a63b 100644
--- a/services/authelia.sh
+++ b/services/authelia.sh
@@ -899,6 +899,39 @@ remove_authelia_domain() {
     fi
 }
 
+# Lists this box's local Caddy sites by number for convenience, then lets
+# the caller pick one OR just type a domain directly — including one not on
+# this box's Caddy at all, since this only ever offers the list, never
+# requires picking from it. Shared by every prompt in this file that needs
+# "a domain, ideally from Caddy" (protecting/un-protecting a site, and the
+# OIDC "what domain is this app on" prompt) so they behave the same way
+# instead of each re-implementing their own version of "type it out fully."
+# Echoes the chosen domain on stdout (empty if nothing entered); the
+# listing itself goes to stderr so it never ends up captured by a caller
+# using $(...) to grab the echoed domain.
+_authelia_pick_domain() {
+    local prompt_label="$1"
+    local caddy_file="$DOCKER_DIR/caddy/Caddyfile"
+    local -a site_domains
+    [ -f "$caddy_file" ] && mapfile -t site_domains < <(grep -oE '^[A-Za-z0-9][A-Za-z0-9.-]*\.[A-Za-z]{2,} \{$' "$caddy_file" | sed 's/ {$//')
+
+    if [ "${#site_domains[@]}" -gt 0 ]; then
+        echo "  Local Caddy sites on this box:" >&2
+        local i
+        for i in "${!site_domains[@]}"; do
+            echo "    $((i + 1))) ${site_domains[$i]}" >&2
+        done
+        echo "  Or type a domain directly — including one on a different box's Caddy." >&2
+    fi
+    local choice=""
+    prompt_text "  ${prompt_label}:" "" choice
+    if [[ "$choice" =~ ^[0-9]+$ ]] && [ "$choice" -ge 1 ] && [ "$choice" -le "${#site_domains[@]}" ]; then
+        echo "${site_domains[$((choice - 1))]}"
+    else
+        echo "$choice"
+    fi
+}
+
 # Generalizes the "Protect X with Authelia SSO?" prompt individual services
 # (magicmirror, wolf-pair, security-dashboard, etc.) each offer on their own
 # install into one menu action here: pick any existing LOCAL Caddy site by
@@ -2364,9 +2397,8 @@ _authelia_add_oidc_client() {
     # ActualBudget after nothing more than a first attempt, with no way
     # through except hand-editing configuration.yml.
 
-    local APP_DOMAIN_DEFAULT="" APP_DOMAIN=""
-    [ -n "${SITE_DOMAIN:-}" ] && [ "$SITE_DOMAIN" != "example.com" ] && APP_DOMAIN_DEFAULT="${CLIENT_ID}.${SITE_DOMAIN}"
-    prompt_text "  Domain ${APP_NAME} is reachable at [${APP_DOMAIN_DEFAULT:-required}]:" "$APP_DOMAIN_DEFAULT" APP_DOMAIN
+    local APP_DOMAIN
+    APP_DOMAIN="$(_authelia_pick_domain "Domain ${APP_NAME} is reachable at (number or domain)")"
     if [ -z "$APP_DOMAIN" ]; then
         log_warning "No domain entered — nothing to do."
         return 0