diff --git a/k8s/apps/cloudflared/configmap.yaml b/k8s/apps/cloudflared/configmap.yaml
index 656469c..2fba788 100644
--- a/k8s/apps/cloudflared/configmap.yaml
+++ b/k8s/apps/cloudflared/configmap.yaml
@@ -53,4 +53,8 @@ data:
       # even though the DNS CNAME points at the tunnel.
       - hostname: zitadel.riotpiao.com
         service: https://zitadel.riotpiao.com
+      # AUTHENTIK. Same reasoning as ZITADEL: a hostname absent from this table
+      # gets 404 from the connector. CoreDNS rewrites the name to ingress-nginx.
+      - hostname: authentik.riotpiao.com
+        service: https://authentik.riotpiao.com
       - service: http_status:404
diff --git a/k8s/bootstrap/ingress/ingress.yaml b/k8s/bootstrap/ingress/ingress.yaml
index 378c9d9..de57a83 100644
--- a/k8s/bootstrap/ingress/ingress.yaml
+++ b/k8s/bootstrap/ingress/ingress.yaml
@@ -275,3 +275,31 @@ spec:
                 name: temporal-web
                 port:
                   number: 8080
+
+---
+# ── Authentik (identity provider) ─────────────────────────────────────────────
+# The chart's ingress is disabled in k8s/infra/iam/authentik-values.yaml; the
+# rule lives here so ingress-config owns every hostname. TLS terminates at
+# nginx via the wildcard default-ssl-certificate, so the backend stays HTTP.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: authentik
+  namespace: iam
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "16m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: authentik.riotpiao.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: authentik-server
+                port:
+                  number: 80