Aah, was closer than I thought.
The UUID override for groups also needs to be set to ‘uid’ for them to show up everywhere.
Nested groups needs to be disabled or listing group members will not work.
Testing through further, but so far everything seems to be working nicely.
Yay for Authentik!