diff --git a/k8s/app/deployment.yaml b/k8s/app/deployment.yaml
index b0ca1af..28a9239 100644
--- a/k8s/app/deployment.yaml
+++ b/k8s/app/deployment.yaml
@@ -1,6 +1,6 @@
 # Poimen Memory API Server
-# Serves 7 HTTP endpoints for memory ingest, query, and management.
-# Connects to memory-db (pgvector) for persistent storage.
+# Serves HTTP endpoints for memory ingest, query, visualization.
+# Connects to memory-db (pgvector) + api.riotpiao.com (LLM via Authentik JWT).
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -60,20 +60,43 @@ spec:
                   key: password
             - name: DATABASE_URL
               value: "postgresql://$(DATABASE_USER):$(DATABASE_PASSWORD)@$(DATABASE_HOST):$(DATABASE_PORT)/$(DATABASE_NAME)?sslmode=disable"
-            # LLM Gateway API key
+
+            # LLM via api.riotpiao.com (Authentik JWT auth)
+            - name: LLM_ENDPOINT
+              value: "https://api.riotpiao.com/v1/chat/completions"
+            - name: LLM_API_BASE
+              value: "https://api.riotpiao.com/v1"
+            - name: LLM_MODEL
+              value: "ornith:35b"
+
+            # Authentik service account (memory-agent-oidc secret)
+            - name: AUTHENTIK_ISSUER
+              valueFrom:
+                secretKeyRef:
+                  name: memory-agent-oidc
+                  key: ISSUER
+            - name: AUTHENTIK_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: memory-agent-oidc
+                  key: CLIENT_ID
+            - name: AUTHENTIK_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: memory-agent-oidc
+                  key: CLIENT_SECRET
+            - name: TOKEN_URL
+              valueFrom:
+                secretKeyRef:
+                  name: memory-agent-oidc
+                  key: TOKEN_URL
+
+            # Server config
             - name: MEM_API_KEY
               valueFrom:
                 secretKeyRef:
                   name: poimen-memory-secrets
                   key: llm-api-key
-            # LLM config (in-cluster, no auth needed)
-            - name: LLM_ENDPOINT
-              value: "http://reasoning-predictor.llm-serving.svc.cluster.local/v1/chat/completions"
-            - name: LLM_API_BASE
-              value: "http://reasoning-predictor.llm-serving.svc.cluster.local/v1"
-            - name: LLM_MODEL
-              value: "reasoning"
-            # Server config (from ConfigMap)
             - name: MEM_PORT
               value: "8080"
             - name: MEM_HOME
@@ -81,10 +104,6 @@ spec:
           envFrom:
             - configMapRef:
                 name: poimen-memory-config
-            - secretRef:
-                name: poimen-memory-auth
-            - secretRef:
-                name: poimen-memory-secrets
           command: ["/app/mem"]
           args:
             - serve
@@ -118,7 +137,6 @@ spec:
         - name: tmp
           emptyDir:
             sizeLimit: 64Mi
-      # Tolerate control-plane nodes
       tolerations:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists