@@ -251,7 +251,26 @@ behavior (their stored row has no auth method and reads back as a bare
 `*fosite.DefaultClient`). This brings the Redis backend in line with the
 in-memory backend, which has always enforced the pinned method.
 
-## Configuration
+## Configured-client reconciliation
+
+Operator-declared delegate and SPIFFE clients are reconciled as one desired set at
+embedded auth-server startup. Redis rows written by this path carry a
+`configured` ownership marker. Rows without that marker are legacy data and are
+never pruned; DCR-issued rows are also excluded.
+
+Redis replicas publish their desired client IDs and logical fingerprints under a
+short-lived lease. A live lease protects its claimed IDs during rolling
+updates. Reconciliation uses cursor-based `SCAN` over the client namespace and
+rechecks candidate rows before deletion, so concurrent registration or
+reconciliation cannot be removed from a stale read. Conflicting fingerprints
+for the same client ID fail reconciliation instead of silently overwriting one
+replica's configuration.
+
+The server performs an initial reconciliation before serving requests, renews
+its lease while running, and releases it before closing storage. Memory storage
+uses the same desired-set semantics under its existing mutex and treats lease
+operations as process-local no-ops.
+
 
 ### CRD Configuration
 
 
@@ -13,6 +13,7 @@ import (
 	"time"
 
 	josev3 "github.com/go-jose/go-jose/v3"
+	"github.com/google/uuid"
 	"github.com/ory/fosite"
 	"github.com/ory/fosite/compose"
 
@@ -49,6 +50,11 @@ type server struct {
 	// TrustedIssuers are configured (nil otherwise). Held here so Close can shut
 	// down its per-issuer JWKS refresh worker pools; nothing else releases them.
 	trustedIssuerValidator *tokenexchange.MultiIssuerTokenValidator
+	configuredReconciler   storage.ConfiguredClientReconciler
+	configuredClients      []fosite.Client
+	configuredLeaseID      string
+	configuredCancel       context.CancelFunc
+	configuredDone         chan struct{}
 }
 
 // DefaultUpstreamFactory creates the production upstream provider based on type.
@@ -172,15 +178,11 @@ func newServer(ctx context.Context, cfg Config, stor storage.Storage) (_ *server
 		return nil, fmt.Errorf("storage backend %T does not implement storage.DCRCredentialStore", baseStore)
 	}
 
-	stor, err := decorateStorageForSPIFFE(ctx, cfg, stor)
+	stor, configuredReconciler, configuredLeaseID, desiredClients, err := setupConfiguredClients(ctx, cfg, stor)
 	if err != nil {
 		return nil, err
 	}
 
-	if err := registerDelegateClients(ctx, stor, cfg.DelegateClients); err != nil {
-		return nil, err
-	}
-
 	slog.Debug("creating OAuth2 configuration")
 
 	// Get signing key from KeyProvider
@@ -279,14 +281,111 @@ func newServer(ctx context.Context, cfg Config, stor storage.Storage) (_ *server
 		"issuer", cfg.Issuer,
 	)
 
-	return &server{
+	srv := &server{
 		handler:                router,
 		storage:                stor,
 		dcrStore:               dcrStore,
 		upstreams:              upstreams,
 		upstreamRefresher:      refresher,
 		trustedIssuerValidator: trustedIssuerValidator,
-	}, nil
+		configuredReconciler:   configuredReconciler,
+		configuredClients:      desiredClients,
+		configuredLeaseID:      configuredLeaseID,
+	}
+	if configuredReconciler != nil {
+		srv.startConfiguredClientLeaseRenewal()
+	}
+	return srv, nil
+}
+
+// startConfiguredClientLeaseRenewal starts a background worker that renews
+// s.configuredLeaseID on a ticker so a healthy replica's lease does not
+// expire and let another replica prune its still-active configuration. The
+// worker stops, and its done channel closes, once s.configuredCancel is
+// called (from Close).
+func (s *server) startConfiguredClientLeaseRenewal() {
+	renewCtx, cancel := context.WithCancel(context.Background())
+	s.configuredCancel = cancel
+	s.configuredDone = make(chan struct{})
+	done := s.configuredDone
+	go func() {
+		ticker := time.NewTicker(10 * time.Second)
+		defer ticker.Stop()
+		defer close(done)
+		for {
+			select {
+			case <-renewCtx.Done():
+				return
+			case <-ticker.C:
+				err := s.configuredReconciler.ReconcileConfiguredClients(renewCtx, s.configuredLeaseID, s.configuredClients)
+				if err != nil {
+					slog.Warn("configured client lease renewal failed", "error", err)
+				}
+			}
+		}
+	}()
+}
+
+// setupConfiguredClients decorates storage for SPIFFE, then reconciles the
+// desired set of operator-configured (delegate) clients against durable
+// storage if the backend supports it, falling back to one-shot delegate
+// registration otherwise. It returns the (possibly wrapped) storage, the
+// reconciler the caller must use for lease renewal and release (nil if the
+// backend doesn't support reconciliation), the lease ID that reconciliation
+// claimed, and the desired client set for later renewal calls.
+func setupConfiguredClients(ctx context.Context, cfg Config, stor storage.Storage) (
+	storage.Storage, storage.ConfiguredClientReconciler, string, []fosite.Client, error,
+) {
+	desiredClients, err := configuredClients(cfg)
+	if err != nil {
+		return nil, nil, "", nil, err
+	}
+	stor, err = decorateStorageForSPIFFE(ctx, cfg, stor)
+	if err != nil {
+		return nil, nil, "", nil, err
+	}
+
+	baseStore := storage.Unwrap(stor)
+	reconciler, ok := baseStore.(storage.ConfiguredClientReconciler)
+	if !ok {
+		if err := registerDelegateClients(ctx, stor, cfg.DelegateClients); err != nil {
+			return nil, nil, "", nil, err
+		}
+		return stor, nil, "", desiredClients, nil
+	}
+
+	leaseID := uuid.NewString()
+	if err := reconciler.ReconcileConfiguredClients(ctx, leaseID, desiredClients); err != nil {
+		return nil, nil, "", nil, fmt.Errorf("reconcile configured clients: %w", err)
+	}
+	return stor, reconciler, leaseID, desiredClients, nil
+}
+
+// configuredClients builds the desired set of operator-declared clients for
+// ClientRegistry reconciliation. SPIFFE static clients are deliberately
+// excluded: they are durably claimed as inert placeholders by
+// decorateStorageForSPIFFE/preflightDurableCollisions, never as the real,
+// token-exchange-capable client this function would otherwise build via
+// registry.staticClients(). Reconciling the real client here would fight
+// that placeholder for the same row (mismatched fingerprint, since the
+// placeholder carries no grant types) and, if it ever won, would durably
+// persist a usable client where only an inert stand-in must ever exist.
+func configuredClients(cfg Config) ([]fosite.Client, error) {
+	clients := make([]fosite.Client, 0, len(cfg.DelegateClients))
+	for _, delegateClient := range cfg.DelegateClients {
+		client, err := registration.NewStaticDelegateClient(registration.Config{
+			ID:         delegateClient.ClientID,
+			Secret:     delegateClient.ClientSecret,
+			GrantTypes: []string{oauthproto.GrantTypeTokenExchange},
+			Scopes:     delegateClient.Scopes,
+			Audience:   delegateClient.Audiences,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to create delegate client %q: %w", delegateClient.ClientID, err)
+		}
+		clients = append(clients, client)
+	}
+	return clients, nil
 }
 
 func registerDelegateClients(ctx context.Context, stor storage.Storage, delegateClients []DelegateClient) error {
@@ -537,6 +636,15 @@ func (s *server) Close() error {
 	slog.Debug("closing OAuth authorization server")
 	s.CloseIdleConnections()
 	var errs []error
+	if s.configuredCancel != nil {
+		s.configuredCancel()
+		<-s.configuredDone
+	}
+	if s.configuredReconciler != nil && s.configuredLeaseID != "" {
+		if err := s.configuredReconciler.ReleaseConfiguredClientLease(context.Background(), s.configuredLeaseID); err != nil {
+			errs = append(errs, fmt.Errorf("failed to release configured client lease: %w", err))
+		}
+	}
 	if s.trustedIssuerValidator != nil {
 		if err := s.trustedIssuerValidator.Close(); err != nil {
 			errs = append(errs, fmt.Errorf("failed to shut down trusted-issuer validator: %w", err))
 
@@ -83,6 +83,11 @@ type MemoryStorage struct {
 	// marker is needed here.
 	clients map[string]fosite.Client
 
+	// configuredClients records rows explicitly owned by operator configuration.
+	// It is separate from the client value so SPIFFE placeholder behavior is not
+	// altered by an ownership marker.
+	configuredClients map[string]struct{}
+
 	// clientOrder is the least-recently-proven-used order of clients: a
 	// registration starts at the back, and RenewClientTTL moves a DCR-issued
 	// client to the back again on proven use (a successful token
@@ -235,6 +240,7 @@ func WithMinClientAge(d time.Duration) MemoryStorageOption {
 func NewMemoryStorage(opts ...MemoryStorageOption) *MemoryStorage {
 	s := &MemoryStorage{
 		clients:               make(map[string]fosite.Client),
+		configuredClients:     make(map[string]struct{}),
 		authCodes:             make(map[string]*timedEntry[fosite.Requester]),
 		accessTokens:          make(map[string]*timedEntry[fosite.Requester]),
 		refreshTokens:         make(map[string]*timedEntry[fosite.Requester]),
@@ -505,9 +511,62 @@ func (s *MemoryStorage) UpsertDCRIssuedClient(_ context.Context, client fosite.C
 	s.clientOrder = slices.DeleteFunc(s.clientOrder, func(e clientOrderEntry) bool { return e.id == id })
 	s.clientOrder = append(s.clientOrder, clientOrderEntry{id: id, touchedAt: time.Now()})
 	s.clients[id] = client
+	delete(s.configuredClients, id)
+	return nil
+}
+
+// ReconcileConfiguredClients atomically applies the complete desired configured
+// client set and removes stale explicitly configured clients.
+func (s *MemoryStorage) ReconcileConfiguredClients(_ context.Context, _ string, clients []fosite.Client) error {
+	desired := make(map[string]fosite.Client, len(clients))
+	for _, client := range clients {
+		if client == nil {
+			return fmt.Errorf("configured client is required")
+		}
+		if registration.DCRIssued(client) {
+			return fmt.Errorf("configured client %q must not carry the DCR-issued marker", client.GetID())
+		}
+		if err := ValidateRegisterableClientID(client.GetID()); err != nil {
+			return err
+		}
+		if _, exists := desired[client.GetID()]; exists {
+			return fmt.Errorf("duplicate configured client %q", client.GetID())
+		}
+		desired[client.GetID()] = client
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for id, client := range desired {
+		if existing, exists := s.clients[id]; exists {
+			if registration.DCRIssued(existing) || !fingerprintOfClient(existing).equal(fingerprintOfClient(client)) {
+				return fmt.Errorf("%w: client %q is already registered", ErrAlreadyExists, id)
+			}
+		}
+	}
+	for id := range s.configuredClients {
+		if _, keep := desired[id]; !keep {
+			delete(s.clients, id)
+			delete(s.configuredClients, id)
+		}
+	}
+	for id, client := range desired {
+		if _, exists := s.clients[id]; exists {
+			s.clientOrder = slices.DeleteFunc(s.clientOrder, func(e clientOrderEntry) bool { return e.id == id })
+		} else if err := s.insertClientLocked(id, client); err != nil {
+			return err
+		}
+		s.clients[id] = client
+		s.configuredClients[id] = struct{}{}
+		s.clientOrder = slices.DeleteFunc(s.clientOrder, func(e clientOrderEntry) bool { return e.id == id })
+		s.clientOrder = append(s.clientOrder, clientOrderEntry{id: id, touchedAt: time.Now()})
+	}
 	return nil
 }
 
+// ReleaseConfiguredClientLease is a no-op for process-local storage.
+func (*MemoryStorage) ReleaseConfiguredClientLease(_ context.Context, _ string) error { return nil }
+
 // ReconcileConfiguredClient applies an operator-declared client: creates it
 // if absent, idempotently replaces a matching-fingerprint configured client
 // (the restart-with-unchanged-config case), or refuses with ErrAlreadyExists
@@ -527,7 +586,11 @@ func (s *MemoryStorage) ReconcileConfiguredClient(_ context.Context, client fosi
 
 	existing, exists := s.clients[id]
 	if !exists {
-		return s.insertClientLocked(id, client)
+		if err := s.insertClientLocked(id, client); err != nil {
+			return err
+		}
+		s.configuredClients[id] = struct{}{}
+		return nil
 	}
 	if registration.DCRIssued(existing) {
 		return fmt.Errorf("%w: client %q is DCR-issued, refusing to overwrite with a configured client",
@@ -543,6 +606,7 @@ func (s *MemoryStorage) ReconcileConfiguredClient(_ context.Context, client fosi
 	s.clientOrder = slices.DeleteFunc(s.clientOrder, func(e clientOrderEntry) bool { return e.id == id })
 	s.clientOrder = append(s.clientOrder, clientOrderEntry{id: id, touchedAt: time.Now()})
 	s.clients[id] = client
+	s.configuredClients[id] = struct{}{}
 	return nil
 }
 
@@ -556,6 +620,7 @@ func (s *MemoryStorage) insertClientLocked(id string, client fosite.Client) erro
 			victim := s.clientOrder[idx].id
 			s.clientOrder = append(s.clientOrder[:idx], s.clientOrder[idx+1:]...)
 			delete(s.clients, victim)
+			delete(s.configuredClients, victim)
 			slog.Debug("evicted oldest DCR-issued client registration at capacity",
 				"client_id", victim, "max_clients", s.maxClients)
 		} else {
 
@@ -380,7 +380,29 @@ func TestMemoryStorage_ReconcileConfiguredClient(t *testing.T) {
 	})
 }
 
-// TestMemoryStorage_UpsertDCRIssuedClient covers the create/replace/reject
+func TestMemoryStorage_ReconcileConfiguredClientsPrunesStaleRows(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+	s := NewMemoryStorage()
+	defer s.Close()
+
+	keep := &mockClient{id: "keep", scopes: []string{"openid"}, public: false}
+	stale := &mockClient{id: "stale", scopes: []string{"openid"}, public: false}
+	dcr := dcrClient(t, "dcr")
+	require.NoError(t, s.ReconcileConfiguredClient(ctx, keep))
+	require.NoError(t, s.ReconcileConfiguredClient(ctx, stale))
+	require.NoError(t, s.RegisterClient(ctx, dcr))
+
+	require.NoError(t, s.ReconcileConfiguredClients(ctx, "memory", []fosite.Client{keep}))
+	_, err := s.GetClient(ctx, "stale")
+	assert.ErrorIs(t, err, ErrNotFound)
+	_, err = s.GetClient(ctx, "keep")
+	require.NoError(t, err)
+	_, err = s.GetClient(ctx, "dcr")
+	require.NoError(t, err)
+}
+
 // matrix UpsertDCRIssuedClient must implement: create when absent, replace
 // (and renew the eviction position) when the existing record is itself
 // DCR-issued, refuse with ErrAlreadyExists when the existing record is NOT