diff --git a/k8s/infra/minio/minio-tenant.yaml b/k8s/infra/minio/minio-tenant.yaml
index 1dc54f2..a166663 100644
--- a/k8s/infra/minio/minio-tenant.yaml
+++ b/k8s/infra/minio/minio-tenant.yaml
@@ -107,6 +107,13 @@ spec:
   # Use external URL for config fetch (hairpins through ingress-nginx); browser
   # redirects use public URLs embedded in the OIDC metadata response.
   env:
+    # MinIO ships identity_openid DISABLED by default, whatever else is set.
+    # Without this key every other MINIO_IDENTITY_OPENID_* value below is
+    # inert and the console advertises password login only — it answers
+    # /api/v1/login with {"loginStrategy":"form"} and never renders an SSO
+    # button, which is exactly the symptom this tenant showed.
+    - name: MINIO_IDENTITY_OPENID_ENABLE
+      value: "on"
     - name: MINIO_IDENTITY_OPENID_CONFIG_URL
       # Must use external URL — well-known response contains external issuer/jwks_uri.
       # MinIO validates issuer in JWT matches well-known issuer. Internal URL = mismatch.
@@ -121,8 +128,9 @@ spec:
           key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
     - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
       value: "groups"
-    - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX
-      value: ""
+    # An empty claim prefix is worse than no key: it makes the claim resolver
+    # prepend nothing and then look for a nested property that cannot exist.
+    # Omit the key entirely unless a real prefix is needed.
     - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
       value: "https://minio.riotpiao.com/oauth_callback"
     - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME