diff --git a/k8s/argocd/apps/30-security.yaml b/k8s/argocd/apps/30-security.yaml
index 04e3a7a..511d5d5 100644
--- a/k8s/argocd/apps/30-security.yaml
+++ b/k8s/argocd/apps/30-security.yaml
@@ -79,6 +79,31 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
+# Raw IAM support manifests: the SMTP -> Gotify notification relay that ZITADEL
+# points at, so verification and password-reset codes reach the phone. Wave 3
+# alongside ZITADEL itself; the Secret it reads is created by sops-secrets at
+# wave 0.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: iam-support
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    targetRevision: main
+    path: k8s/infra/iam
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: iam
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+---
 # Forgejo itself. Was a bootstrap Helm release (phase 3) until it was brought
 # under Argo, because values changes there were inert — a proxy-body-size fix
 # sat committed while the live Ingress kept nginx's 1m default and rejected
diff --git a/k8s/infra/iam/kustomization.yaml b/k8s/infra/iam/kustomization.yaml
index d134eb6..6231b67 100644
--- a/k8s/infra/iam/kustomization.yaml
+++ b/k8s/infra/iam/kustomization.yaml
@@ -2,7 +2,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - rbac-dashboard-rolebinding.yaml
+  # Removed: rbac-dashboard-rolebinding.yaml (authentik-provisioner SA and
+  # RoleBinding). Authentik is retired, so the file is gone; keep this list in
+  # step with the directory or kustomize fails the whole app.
   - smtp-gotify.yaml
 
 # IAM provisioning is manual-only (security-sensitive).