diff --git a/docs/sso.md b/docs/sso.md
index 1cb79e8..8645bf1 100644
--- a/docs/sso.md
+++ b/docs/sso.md
@@ -111,8 +111,9 @@ feeds.
 
 Authentik's library lists Authentik's own applications, and ipx signs in through the one
 called `Cloudflare Access`, so ipx needs a bookmark of its own to show up there. It is
-Applications → Applications → `ipodderx`: no provider, launch URL `https://ipodderx.sdf1.net`, and
-the ipx logo. Like Outline's, it has no policy bindings, so everyone in Authentik sees the
+Applications → Applications → `iPX` (slug `ipodderx`): no provider, launch URL
+`https://ipodderx.sdf1.net`, and web/logo.svg at 512px as its icon, uploaded again when the logo
+changes. Like Outline's, it has no policy bindings, so everyone in Authentik sees the
 tile. Who actually gets in is still up to the Access policy.
 
 ### Check it