diff --git a/k8s/apps/poimen/frontend-deployment.yaml b/k8s/apps/poimen/frontend-deployment.yaml
index ccef17a..985cd18 100644
--- a/k8s/apps/poimen/frontend-deployment.yaml
+++ b/k8s/apps/poimen/frontend-deployment.yaml
@@ -55,11 +55,10 @@ spec:
                   name: poimen-config
                   key: POIMEN_MEMORY_URL
             # OIDC — uses same client as existing poimen services
+            # Use in-cluster Authentik (port 80 → pod 9000) to avoid Cloudflare hairpin.
+            # External URL in poimen-secrets is for out-of-cluster clients only.
             - name: LLM_OIDC_TOKEN_URL
-              valueFrom:
-                secretKeyRef:
-                  name: poimen-secrets
-                  key: LLM_OIDC_TOKEN_URL
+              value: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
             - name: LLM_OIDC_CLIENT_ID
               valueFrom:
                 secretKeyRef: