diff --git a/Enabling-SSO-support-using-OpenId-Connect.md b/Enabling-SSO-support-using-OpenId-Connect.md
index 86b99b0..003e91b 100644
--- a/Enabling-SSO-support-using-OpenId-Connect.md
+++ b/Enabling-SSO-support-using-OpenId-Connect.md
@@ -236,7 +236,9 @@ To obtain a `refresh_token` to be able to extend session you'll need to add the
 
 Additionally Zitadel include the `Project id` and the `Client Id` in the audience of the Id Token.
 For the validation to work you will need to add the `Resource Id` as a trusted audience (`Client Id` is trusted by default).
-You can control the trusted audience with the config `SSO_AUDIENCE_TRUSTED`
+You can control the trusted audience with the config `SSO_AUDIENCE_TRUSTED`.
+
+According to [Zitadel#9200](https://github.com/zitadel/zitadel/issues/9200), `id_token` passes a list of trusted audiences including the `Project Id`. If you end up having many trusted `aud` strings, `SSO_AUDIENCE_TRUSTED`, may become unmanageable. In such cases, `SSO_AUDIENCE_TRUSTED: '^\d{18}$'` (18 is the size of each string in `aud` list, it may differ depending on your Zitadel implementation) would help you but it's safe to individually add all the `aud` strings like `SSO_AUDIENCE_TRUSTED: '^abcd|def|xyz$'`. 
 
 Since [zitadel#721](https://github.com/zitadel/oidc/pull/721) PKCE should work with client secret.
 But older versions might have to disable it (`SSO_PKCE=false`).