diff --git a/auth-proxy/src/oidc.ts b/auth-proxy/src/oidc.ts
index 6d74ab7..df397ad 100644
--- a/auth-proxy/src/oidc.ts
+++ b/auth-proxy/src/oidc.ts
@@ -61,9 +61,9 @@ export async function issueIdToken(params: {
   // sub = full cashaddr (immutable identity). preferred_username = a Forgejo-safe
   // rendering: "bch_" + first 20 chars of the address payload. Forgejo usernames
   // must match [a-zA-Z0-9-_.]+ (no colons) and be <= 40 chars.
-  const addressPayload = params.subject.startsWith("bitcoincash:")
-    ? params.subject.slice("bitcoincash:".length)
-    : params.subject;
+  // Strip ANY CashAddr prefix (bitcoincash: / bchtest: / bchreg:) — the payload
+  // after the colon is the part we want to render as a Forgejo username.
+  const addressPayload = params.subject.replace(/^[a-z]+:/, "");
   const preferredUsername = `bch_${addressPayload.slice(0, 20)}`;
   const jwt = await new SignJWT({
     preferred_username: preferredUsername,