diff --git a/k8s/security/iam/authentik-provision-job.yaml b/k8s/security/iam/authentik-provision-job.yaml
index 5caa541..840f6d9 100644
--- a/k8s/security/iam/authentik-provision-job.yaml
+++ b/k8s/security/iam/authentik-provision-job.yaml
@@ -154,8 +154,16 @@ data:
         {
             "name": "homelab: groups claim",
             "scope_name": "groups",
+            # request.user.ak_groups is deprecated in authentik 2026.x (logs a
+            # deprecation warning on every token issue) -> use request.user.groups.
             "expression": (
-                "return {\"groups\": [group.name for group in request.user.ak_groups.all()]}"
+                "return {\"groups\": [group.name for group in request.user.groups.all()]}"
+            ),
+        },
+        # Force the expression onto the already-created mapping on re-run.
+        patch_existing={
+            "expression": (
+                "return {\"groups\": [group.name for group in request.user.groups.all()]}"
             ),
         },
     )
@@ -292,15 +300,22 @@ data:
                 "property_mappings": SCOPE_PKS,
                 "sub_mode": "hashed_user_id",
                 "include_claims_in_id_token": True,
+                # authentik 2026.x requires grant_types to be set explicitly; the
+                # API defaults it to [] when omitted, which makes /authorize reject
+                # every login with "Invalid grant_type for provider" ->
+                # invalid_request. authorization_code = the web SSO flow all these
+                # apps use; refresh_token = long-lived sessions (offline_access).
+                "grant_types": ["authorization_code", "refresh_token"],
                 "redirect_uris": [
                     {"matching_mode": "strict", "url": u} for u in cfg["redirect_uris"]
                 ],
             },
-            # Keep the redirect_uris/mappings in sync on re-run, but never touch
-            # client_secret again once created (that's the source of truth in the
-            # k8s Secret, and re-sending it here is harmless/idempotent anyway).
+            # Keep the redirect_uris/mappings/grant_types in sync on re-run, but
+            # never touch client_secret again once created (that's the source of
+            # truth in the k8s Secret, and re-sending it here is harmless anyway).
             patch_existing={
                 "property_mappings": SCOPE_PKS,
+                "grant_types": ["authorization_code", "refresh_token"],
                 "redirect_uris": [
                     {"matching_mode": "strict", "url": u} for u in cfg["redirect_uris"]
                 ],