diff --git a/examples/values.yaml b/examples/values.yaml
index 6f9112a..b55ec98 100644
--- a/examples/values.yaml
+++ b/examples/values.yaml
@@ -43,9 +43,13 @@ global:
     tenantId: ""
     clientId: ""
     clientSecret: ""
+    # -- Audience for token validation (defaults to api://<clientId> if not set)
+    # This must match the Application ID URI in your App Registration
+    audience: ""
     scopes: "access_as_user"
-    # -- Azure SDK scope for client credentials flow (e.g., api://activityregistry/.default)
+    # -- Azure SDK scope for client credentials flow (defaults to api://<clientId>/.default if not set)
     # Used by activities for service-to-service authentication
+    # Must match the audience with /.default suffix
     scope: ""
 
   # -- Database configuration