diff --git a/internal/jellyfin/jellyfin.go b/internal/jellyfin/jellyfin.go
index a17dd57..6fec3cd 100644
--- a/internal/jellyfin/jellyfin.go
+++ b/internal/jellyfin/jellyfin.go
@@ -78,7 +78,10 @@ func (c *Client) RefreshLibraries(ctx context.Context) error {
 	if err != nil {
 		return fmt.Errorf("jellyfin: build request: %w", err)
 	}
-	req.Header.Set("X-Emby-Token", c.apiKey)
+	// Схема MediaBrowser в Authorization — единственный способ авторизации,
+	// который Jellyfin 12 принимает по умолчанию: X-Emby-Token и прочие
+	// legacy-заголовки выключены (EnableLegacyAuthorization=false).
+	req.Header.Set("Authorization", `MediaBrowser Token="`+c.apiKey+`"`)
 
 	log := logctx.FromOr(ctx, c.log)
 	call := logging.StartCall(logging.ServiceJellyfin, "library/refresh")
diff --git a/internal/jellyfin/jellyfin_test.go b/internal/jellyfin/jellyfin_test.go
index 83a5e61..f339c7e 100644
--- a/internal/jellyfin/jellyfin_test.go
+++ b/internal/jellyfin/jellyfin_test.go
@@ -8,11 +8,12 @@ import (
 )
 
 func TestRefreshLibraries_OK(t *testing.T) {
-	var gotPath, gotToken, gotMethod string
+	var gotPath, gotAuth, gotLegacy, gotMethod string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		gotMethod = r.Method
 		gotPath = r.URL.Path
-		gotToken = r.Header.Get("X-Emby-Token")
+		gotAuth = r.Header.Get("Authorization")
+		gotLegacy = r.Header.Get("X-Emby-Token")
 		w.WriteHeader(http.StatusNoContent)
 	}))
 	defer srv.Close()
@@ -30,8 +31,11 @@ func TestRefreshLibraries_OK(t *testing.T) {
 	if gotPath != "/Library/Refresh" {
 		t.Errorf("path = %q, want /Library/Refresh", gotPath)
 	}
-	if gotToken != "secret" {
-		t.Errorf("token = %q, want secret", gotToken)
+	if want := `MediaBrowser Token="secret"`; gotAuth != want {
+		t.Errorf("Authorization = %q, want %q", gotAuth, want)
+	}
+	if gotLegacy != "" {
+		t.Errorf("X-Emby-Token = %q, want пусто (legacy-заголовок выключен в Jellyfin 12)", gotLegacy)
 	}
 }