diff --git a/k8s/infra/databases/authentik-db.yaml b/k8s/infra/databases/authentik-db.yaml
new file mode 100644
index 0000000..03c88e8
--- /dev/null
+++ b/k8s/infra/databases/authentik-db.yaml
@@ -0,0 +1,38 @@
+# Dedicated CNPG Postgres for Authentik (GitOps, wave 2 — before authentik w3).
+# CNPG generates secret `authentik-db-app` + service `authentik-db-rw` in ns iam;
+# authentik-values reads them locally (no cross-ns secret copy).
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: authentik-db
+  namespace: iam
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.2
+  bootstrap:
+    initdb:
+      database: authentik
+      owner: app
+      encoding: UTF8
+      localeCollate: C
+      localeCType: C
+  enableSuperuserAccess: false
+  resources:
+    requests: { memory: "512Mi", cpu: "250m" }
+    limits: { memory: "2Gi", cpu: "1" }
+  storage:
+    size: 10Gi
+    storageClass: longhorn-cnpg
+  monitoring:
+    enablePodMonitor: true
+  affinity:
+    # preferred + tolerations: HA across nodes without deadlocking a partly-
+    # schedulable 3-CP (same as forgejo-db).
+    podAntiAffinityType: preferred
+    topologyKey: kubernetes.io/hostname
+    tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
diff --git a/k8s/infra/databases/kustomization.yaml b/k8s/infra/databases/kustomization.yaml
index 1afd211..339d52b 100644
--- a/k8s/infra/databases/kustomization.yaml
+++ b/k8s/infra/databases/kustomization.yaml
@@ -6,6 +6,7 @@ kind: Kustomization
 # deployed into it. paperless ns declared in namespaces.yaml above.
 resources:
   - namespaces.yaml
+  - authentik-db.yaml
   - temporal-db.yaml
   - memory-db.yaml
   - paperless-db.yaml