diff --git a/internal/cmd/auth.go b/internal/cmd/auth.go
index 56f4d78..657bc9e 100644
--- a/internal/cmd/auth.go
+++ b/internal/cmd/auth.go
@@ -485,7 +485,7 @@ type AuthAddCmd struct {
 	ServicesCSV  string        `name:"services" help:"Services to authorize: user|all or comma-separated ${auth_services} (Keep uses service account: gog auth service-account set)" default:"user"`
 	Readonly     bool          `name:"readonly" help:"Use read-only scopes where available (still includes OIDC identity scopes)"`
 	DriveScope   string        `name:"drive-scope" help:"Drive scope mode: full|readonly|file" enum:"full,readonly,file" default:"full"`
-	GmailScope   string `name:"gmail-scope" help:"Gmail scope mode: full|readonly" enum:"full,readonly" default:"full"`
+	GmailScope   string        `name:"gmail-scope" help:"Gmail scope mode: full|readonly" enum:"full,readonly" default:"full"`
 }
 
 func (c *AuthAddCmd) Run(ctx context.Context, flags *RootFlags) error {
@@ -551,14 +551,14 @@ func (c *AuthAddCmd) Run(ctx context.Context, flags *RootFlags) error {
 			if authURL != "" || authCode != "" {
 				return usage("remote step 1 does not accept --auth-url or --auth-code")
 			}
-				result, manualErr := manualAuthURL(ctx, googleauth.AuthorizeOptions{
-					Services:                    services,
-					Scopes:                      scopes,
-					Manual:                      true,
-					ForceConsent:                c.ForceConsent,
-					DisableIncludeGrantedScopes: disableIncludeGrantedScopes,
-					Client:                      client,
-				})
+			result, manualErr := manualAuthURL(ctx, googleauth.AuthorizeOptions{
+				Services:                    services,
+				Scopes:                      scopes,
+				Manual:                      true,
+				ForceConsent:                c.ForceConsent,
+				DisableIncludeGrantedScopes: disableIncludeGrantedScopes,
+				Client:                      client,
+			})
 			if manualErr != nil {
 				return manualErr
 			}
@@ -595,13 +595,13 @@ func (c *AuthAddCmd) Run(ctx context.Context, flags *RootFlags) error {
 		"manual":        c.Manual,
 		"remote":        c.Remote,
 		"step":          c.Step,
-			"force_consent": c.ForceConsent,
-			"readonly":      c.Readonly,
-			"drive_scope":   c.DriveScope,
-			"gmail_scope":   c.GmailScope,
-		}); dryRunErr != nil {
-			return dryRunErr
-		}
+		"force_consent": c.ForceConsent,
+		"readonly":      c.Readonly,
+		"drive_scope":   c.DriveScope,
+		"gmail_scope":   c.GmailScope,
+	}); dryRunErr != nil {
+		return dryRunErr
+	}
 
 	// Pre-flight: ensure keychain is accessible before starting OAuth
 	if keychainErr := ensureKeychainAccessIfNeeded(); keychainErr != nil {
diff --git a/internal/cmd/auth_add_test.go b/internal/cmd/auth_add_test.go
index eaa1a09..0ec3e30 100644
--- a/internal/cmd/auth_add_test.go
+++ b/internal/cmd/auth_add_test.go
@@ -324,7 +324,7 @@ func TestAuthAddCmd_GmailScopeReadonly(t *testing.T) {
 		gotOpts.Scopes = append([]string(nil), opts.Scopes...)
 		return "rt", nil
 	}
-	fetchAuthorizedEmail = func(context.Context, string, []string, time.Duration) (string, error) {
+	fetchAuthorizedEmail = func(context.Context, string, string, []string, time.Duration) (string, error) {
 		return "user@example.com", nil
 	}
 
@@ -392,7 +392,7 @@ func TestAuthAddCmd_DriveScopeReadonly(t *testing.T) {
 		gotOpts.Scopes = append([]string(nil), opts.Scopes...)
 		return "rt", nil
 	}
-	fetchAuthorizedEmail = func(context.Context, string, []string, time.Duration) (string, error) {
+	fetchAuthorizedEmail = func(context.Context, string, string, []string, time.Duration) (string, error) {
 		return "user@example.com", nil
 	}
 
diff --git a/internal/googleauth/oauth_flow.go b/internal/googleauth/oauth_flow.go
index 3060af2..c31f788 100644
--- a/internal/googleauth/oauth_flow.go
+++ b/internal/googleauth/oauth_flow.go
@@ -20,16 +20,16 @@ import (
 )
 
 type AuthorizeOptions struct {
-	Services     []Service
-	Scopes       []string
-	Manual       bool
-	ForceConsent bool
+	Services                    []Service
+	Scopes                      []string
+	Manual                      bool
+	ForceConsent                bool
 	DisableIncludeGrantedScopes bool
-	Timeout      time.Duration
-	Client       string
-	AuthCode     string
-	AuthURL      string
-	RequireState bool
+	Timeout                     time.Duration
+	Client                      string
+	AuthCode                    string
+	AuthURL                     string
+	RequireState                bool
 }
 
 type ManualAuthURLResult struct {