diff --git a/src/core/auth/guards/jwt.guard.ts b/src/core/auth/guards/jwt.guard.ts
index 0b7a1b5..f6e68bb 100644
--- a/src/core/auth/guards/jwt.guard.ts
+++ b/src/core/auth/guards/jwt.guard.ts
@@ -11,12 +11,12 @@ export class JwtGuard extends AuthGuard('jwt') {
     return super.canActivate(context);
   }
 
-  handleRequest(err: any, user: any, info: any) {
+  handleRequest(err: any, user: any, info: any, context?: any) {
     if (err || !user) {
       this.logger.debug(`JwtGuard handleRequest failed. err=${err} user=${!!user} info=${JSON.stringify(info)}`);
     } else {
       this.logger.debug(`JwtGuard handleRequest success user=${JSON.stringify(user)}`);
     }
-    return super.handleRequest(err, user, info);
+    return super.handleRequest(err, user, info, context);
   }
 }
diff --git a/src/core/auth/guards/refresh.guard.ts b/src/core/auth/guards/refresh.guard.ts
index 817a0c9..e407d2d 100644
--- a/src/core/auth/guards/refresh.guard.ts
+++ b/src/core/auth/guards/refresh.guard.ts
@@ -11,12 +11,12 @@ export class RefreshGuard extends AuthGuard('refresh') {
     return super.canActivate(context);
   }
 
-  handleRequest(err: any, user: any, info: any) {
+  handleRequest(err: any, user: any, info: any, context?: any) {
     if (err || !user) {
       this.logger.debug(`RefreshGuard handleRequest failed. err=${err} user=${!!user} info=${JSON.stringify(info)}`);
     } else {
       this.logger.debug(`RefreshGuard handleRequest success userId=${user.id} authInfo=${JSON.stringify(info)}`);
     }
-    return super.handleRequest(err, user, info);
+    return super.handleRequest(err, user, info, context);
   }
 }
diff --git a/src/modules/auth/auth.controller.ts b/src/modules/auth/auth.controller.ts
index cfbc36b..42516e9 100644
--- a/src/modules/auth/auth.controller.ts
+++ b/src/modules/auth/auth.controller.ts
@@ -3,8 +3,8 @@ import { Controller, Get, Post, Query, Res, Req, Body, HttpCode, HttpStatus, Log
 import { ApiTags, ApiOperation } from '@nestjs/swagger';
 import { AuthService } from './auth.service';
 import { Response, Request } from 'express';
-import { JwtGuard } from '../../../core/auth/guards/jwt.guard';
-import { RefreshGuard } from '../../../core/auth/guards/refresh.guard';
+import { JwtGuard } from '../../core/auth/guards/jwt.guard';
+import { RefreshGuard } from '../../core/auth/guards/refresh.guard';
 import { ConfigService } from '@nestjs/config';
 
 @ApiTags('Auth')
diff --git a/src/modules/auth/auth.service.ts b/src/modules/auth/auth.service.ts
index 5f83179..05d95dc 100644
--- a/src/modules/auth/auth.service.ts
+++ b/src/modules/auth/auth.service.ts
@@ -6,7 +6,9 @@ import { IUser } from '../identity/domain/repositories/user.interface';
 import { PrismaService } from '../../shared/prisma.service';
 import { RedisPkceStore } from './pkce/redis-pkce.store';
 import { InMemoryRefreshStore } from './refresh/inmemory-refresh.store';
-import { Issuer, generators, Client, TokenSet } from 'openid-client';
+// dynamic require to avoid TypeScript typing issues with installed openid-client
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const OpenIDClient = require('openid-client');
 import crypto from 'crypto';
 
 const logger = new Logger('AuthService');
@@ -23,14 +25,14 @@ export class AuthService {
     private readonly refreshStore: InMemoryRefreshStore,
   ) {}
 
-  private issuer: Issuer<Client> | null = null;
-  private client: Client | null = null;
+  private issuer: any | null = null;
+  private client: any | null = null;
 
   private async getIssuer() {
     if (this.issuer) return this.issuer;
     const issuerUrl = this.config.get<string>('AUTHENTIK_ISSUER');
     if (!issuerUrl) throw new Error('AUTHENTIK_ISSUER not configured');
-    this.issuer = await Issuer.discover(issuerUrl);
+    this.issuer = await OpenIDClient.Issuer.discover(issuerUrl);
     return this.issuer;
   }
 
@@ -53,9 +55,9 @@ export class AuthService {
     }
 
     const state = crypto.randomUUID();
-    const code_verifier = generators.codeVerifier();
-    const code_challenge = await generators.codeChallenge(code_verifier);
-    const nonce = generators.nonce();
+    const code_verifier = OpenIDClient.generators.codeVerifier();
+    const code_challenge = await OpenIDClient.generators.codeChallenge(code_verifier);
+    const nonce = OpenIDClient.generators.nonce();
 
     // save PKCE session keyed by state
     await this.pkceStore.save(state, { code_verifier, nonce, returnTo }, 300);
@@ -84,7 +86,7 @@ export class AuthService {
     if (!redirectUri) throw new Error('AUTHENTIK_REDIRECT_URI is not configured');
 
     // Exchange code for tokens. Provide explicit checks: state, nonce and code_verifier.
-    let tokenSet: TokenSet;
+    let tokenSet: any;
     try {
       tokenSet = await client.callback(
         redirectUri,