diff --git a/k8s/infra/logging/grafana-values.yaml b/k8s/infra/logging/grafana-values.yaml
index 37bbf20..cef8e08 100644
--- a/k8s/infra/logging/grafana-values.yaml
+++ b/k8s/infra/logging/grafana-values.yaml
@@ -90,7 +90,7 @@ grafana.ini:
     allow_assign_grafana_admin: true
     use_pkce: false
     use_refresh_token: false
-    skip_org_role_sync: true  # Skip org role sync to allow first-time user creation
+    skip_org_role_sync: false  # Sync org roles from OAuth groups
     tls_skip_verify_insecure: true   # Authentik uses self-signed cert; verify in prod
 
 # GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET is injected from the grafana-oidc K8s