diff --git a/k8s/configmap.yaml b/k8s/configmap.yaml
index 3de43b4..a8e4516 100644
--- a/k8s/configmap.yaml
+++ b/k8s/configmap.yaml
@@ -14,9 +14,10 @@ data:
     # All Authentik providers share same signing key, so any JWKS URL works.
     # Issuer varies per provider (portfolio-agent, memory-agent, local-llm, etc.)
     # Gateway validates: signature + roles claim contains requiredCapability
+    # Use in-cluster URL to avoid external DNS/network issues
     auth:
       enabled: true
-      jwksUrl: "https://authentik.riotpiao.com/application/o/local-llm/jwks/"
+      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/local-llm/jwks/"
       requiredCapability: "llm:inference"
     
     # Routes: standard HTTP proxy routes (not LLM-specific)