diff --git a/app/playbooks/nextcloud.py b/app/playbooks/nextcloud.py
index 6a363a6..5e58a26 100644
--- a/app/playbooks/nextcloud.py
+++ b/app/playbooks/nextcloud.py
@@ -59,11 +59,13 @@ def build_nextcloud_initial_setup_step(
     allowed_domain = parsed.netloc  # e.g., "cloud.example.com"
 
     return {
-        "scenario": "nextcloud.initial_setup",
+        "scenario": "nextcloud_initial_setup",
         "inputs": {
             "base_url": base_url,
             "admin_username": admin_username,
             "admin_password": admin_password,
+        },
+        "options": {
             "allowed_domains": [allowed_domain],
         },
         "timeout": 120,
diff --git a/tests/test_playbooks_nextcloud.py b/tests/test_playbooks_nextcloud.py
index df69a99..d6feaae 100644
--- a/tests/test_playbooks_nextcloud.py
+++ b/tests/test_playbooks_nextcloud.py
@@ -35,7 +35,7 @@ class TestBuildNextcloudInitialSetupStep:
             admin_password="securepassword123",
         )
 
-        assert payload["scenario"] == "nextcloud.initial_setup"
+        assert payload["scenario"] == "nextcloud_initial_setup"
         assert "inputs" in payload
         assert "timeout" in payload
 
@@ -51,7 +51,9 @@ class TestBuildNextcloudInitialSetupStep:
         assert inputs["base_url"] == "https://cloud.example.com"
         assert inputs["admin_username"] == "admin"
         assert inputs["admin_password"] == "securepassword123"
-        assert "allowed_domains" in inputs
+        # allowed_domains should be in options, not inputs
+        assert "options" in payload
+        assert "allowed_domains" in payload["options"]
 
     def test_allowed_domains_extracted_from_url(self):
         """Verify that allowed_domains is extracted from base_url."""
@@ -61,7 +63,7 @@ class TestBuildNextcloudInitialSetupStep:
             admin_password="password",
         )
 
-        assert payload["inputs"]["allowed_domains"] == ["cloud.example.com"]
+        assert payload["options"]["allowed_domains"] == ["cloud.example.com"]
 
     def test_allowed_domains_with_port(self):
         """Verify that allowed_domains handles URLs with ports."""
@@ -71,7 +73,7 @@ class TestBuildNextcloudInitialSetupStep:
             admin_password="password",
         )
 
-        assert payload["inputs"]["allowed_domains"] == ["cloud.example.com:8443"]
+        assert payload["options"]["allowed_domains"] == ["cloud.example.com:8443"]
 
     def test_timeout_is_set(self):
         """Verify that timeout is set in the payload."""
@@ -120,7 +122,7 @@ class TestCreateNextcloudInitialSetupTask:
             admin_password="password",
         )
 
-        assert task.payload["scenario"] == "nextcloud.initial_setup"
+        assert task.payload["scenario"] == "nextcloud_initial_setup"
 
     async def test_task_payload_contains_inputs(
         self, db: AsyncSession, test_tenant: Tenant
@@ -139,7 +141,8 @@ class TestCreateNextcloudInitialSetupTask:
         assert inputs["base_url"] == "https://cloud.example.com"
         assert inputs["admin_username"] == "testadmin"
         assert inputs["admin_password"] == "testpassword123"
-        assert inputs["allowed_domains"] == ["cloud.example.com"]
+        # allowed_domains should be in options, not inputs
+        assert task.payload["options"]["allowed_domains"] == ["cloud.example.com"]
 
     async def test_task_persisted_to_database(
         self, db: AsyncSession, test_tenant: Tenant