diff --git a/changelog/3.0.0_2023-05-22/fix-idp-sub-recreation.md b/changelog/3.0.0_2023-05-22/fix-idp-sub-recreation.md
index 7ce6ad4fc..da1d954e1 100644
--- a/changelog/3.0.0_2023-05-22/fix-idp-sub-recreation.md
+++ b/changelog/3.0.0_2023-05-22/fix-idp-sub-recreation.md
@@ -7,6 +7,12 @@ use the user's unique id (`owncloudUUID` by default) for computing the `sub`
 claim. So that user's recreated with the same name will be treated as different
 users by the IDP.
 
+This changed also the default values of the 'PROXY_USER_OIDC_CLAIM' and
+'PROXY_USER_CS3_CLAIM' settings map the IDP users to CS3 user by the userid in
+the default setup. The old behavior of matching by username can be achieved
+byt setting 'PROXY_USER_OIDC_CLAIM=preferred_username' and
+'PROXY_USER_CS3_CLAIM=username'.
+
 https://github.com/owncloud/ocis/issues/904
 https://github.com/owncloud/ocis/pull/6326
 https://github.com/owncloud/ocis/pull/6338
diff --git a/deployments/examples/ocis_keycloak/docker-compose.yml b/deployments/examples/ocis_keycloak/docker-compose.yml
index da47ef1e3..5ffafdba6 100644
--- a/deployments/examples/ocis_keycloak/docker-compose.yml
+++ b/deployments/examples/ocis_keycloak/docker-compose.yml
@@ -69,6 +69,8 @@ services:
       OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL:-info}
       OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
       PROXY_TLS: "false" # do not use SSL between Traefik and oCIS
+      PROXY_USER_OIDC_CLAIM: "preferred_username"
+      PROXY_USER_CS3_CLAIM: "username"
       # INSECURE: needed if oCIS / Traefik is using self generated certificates
       OCIS_INSECURE: "${INSECURE:-false}"
       OCIS_ADMIN_USER_ID: ""