- Change MINIO_IDENTITY_OPENID_CLAIM_NAME from 'policy' to 'groups' - Add MINIO_IDENTITY_OPENID_CLAIM_PREFIX (empty) to use raw group names - Update scopes to 'openid,profile,email,groups' - Enables Authentik group-based access (homelab-admins, minio-admins, etc) - Users in homelab-admins group will get admin access to MinIO