diff --git a/pkg/auth/oauth/client.go b/pkg/auth/oauth/client.go
index 17e3b92..4a36932 100644
--- a/pkg/auth/oauth/client.go
+++ b/pkg/auth/oauth/client.go
@@ -73,14 +73,21 @@ func RedirectURI(baseURL string) string {
 }
 
 // GetDefaultScopes returns the default OAuth scopes for ATCR registry operations.
-// Uses io.atcr.permissions#registry permission-set to bundle repo and rpc scopes.
+// Includes io.atcr.authFullApp permission-set plus individual scopes for PDS compatibility.
 // Blob scopes are listed explicitly (not supported in Lexicon permission-sets).
 func GetDefaultScopes(did string) []string {
 	return []string{
 		"atproto",
-		// Permission-set bundles repo and rpc scopes
+		// Permission-set (for future PDS support)
 		// See lexicons/io/atcr/authFullApp.json for definition
 		"io.atcr.authFullApp",
+		// Individual repo/rpc scopes (for current PDS compatibility)
+		fmt.Sprintf("repo:%s", atproto.ManifestCollection),
+		fmt.Sprintf("repo:%s", atproto.TagCollection),
+		fmt.Sprintf("repo:%s", atproto.StarCollection),
+		fmt.Sprintf("repo:%s", atproto.SailorProfileCollection),
+		fmt.Sprintf("repo:%s", atproto.RepoPageCollection),
+		"rpc:com.atproto.repo.getRecord?aud=*",
 		// Blob scopes (not supported in Lexicon permission-sets)
 		// Image manifest types (single-arch)
 		"blob:application/vnd.oci.image.manifest.v1+json",