diff --git a/cmd/hold/main.go b/cmd/hold/main.go
index ba8eb3f..5291fe0 100644
--- a/cmd/hold/main.go
+++ b/cmd/hold/main.go
@@ -768,9 +768,19 @@ func main() {
 	// This is referenced by its client ID URL
 	mux.HandleFunc("/client-metadata.json", func(w http.ResponseWriter, r *http.Request) {
 		// Create a temporary config to generate metadata (indigo provides this)
-		redirectURI := cfg.Server.PublicURL + "/oauth/callback"
+		redirectURI := cfg.Server.PublicURL + "/auth/oauth/callback"
 		clientID := cfg.Server.PublicURL + "/client-metadata.json"
-		scopes := []string{"atproto"} // Hold service uses default scopes
+
+		// Define scopes needed for hold registration
+		scopes := []string{
+			"atproto",
+			fmt.Sprintf("repo:%s?action=create", atproto.HoldCollection),
+			fmt.Sprintf("repo:%s?action=update", atproto.HoldCollection),
+			fmt.Sprintf("repo:%s?action=create", atproto.HoldCrewCollection),
+			fmt.Sprintf("repo:%s?action=update", atproto.HoldCrewCollection),
+			fmt.Sprintf("repo:%s?action=create", atproto.SailorProfileCollection),
+			fmt.Sprintf("repo:%s?action=update", atproto.SailorProfileCollection),
+		}
 
 		config := indigooauth.NewPublicConfig(clientID, redirectURI, scopes)
 		metadata := config.ClientMetadata()
@@ -1035,6 +1045,8 @@ func (s *HoldService) registerWithOAuth(publicURL, handle, did, pdsEndpoint stri
 		fmt.Sprintf("repo:%s?action=update", atproto.HoldCollection),
 		fmt.Sprintf("repo:%s?action=create", atproto.HoldCrewCollection),
 		fmt.Sprintf("repo:%s?action=update", atproto.HoldCrewCollection),
+		fmt.Sprintf("repo:%s?action=create", atproto.SailorProfileCollection),
+		fmt.Sprintf("repo:%s?action=update", atproto.SailorProfileCollection),
 	}
 
 	// Determine base URL based on mode