diff --git a/HOMARR-NEXT-STEPS.md b/HOMARR-NEXT-STEPS.md
new file mode 100644
index 0000000..13551a4
--- /dev/null
+++ b/HOMARR-NEXT-STEPS.md
@@ -0,0 +1,137 @@
+# Homarr Deployment - Next Steps
+
+## Completed
+✅ MinIO OIDC fully wired (k8s/infrastructure/minio/minio-tenant.yaml)
+✅ Homarr base config created:
+   - homarr-values.yaml (SSO env vars)
+   - homarr-secrets.enc.yaml (SECRET_ENCRYPTION_KEY)
+   - kustomization.yaml (namespace: dashboard)
+
+## TODO to Complete Homarr Deployment
+
+### 1. Add Homarr to Authentik Provision Script
+**File:** `k8s/security/iam/scripts/authentik-provision.py`
+**Location:** In the `SERVICES` dict (around line 205), add:
+
+```python
+"homarr": {
+    "client_secret_source": ("dashboard", "homarr-oidc", "client-secret"),
+    "generate_if_missing": True,
+    "extra_secret_literals": {"client-id": "homarr"},
+    "redirect_uris": [
+        "https://homarr.riotpiao.com/api/auth/callback/oidc",
+    ],
+    "launch_url": "https://homarr.riotpiao.com",
+    "display_name": "Homarr",
+},
+```
+
+### 2. Add Dashboard RoleBinding for Authentik Provisioner
+**File:** `k8s/security/iam/kustomization.yaml`
+**Location:** In the `resources:` list, add:
+
+```yaml
+  - rbac-dashboard-rolebinding.yaml
+```
+
+**New file:** `k8s/security/iam/rbac-dashboard-rolebinding.yaml`:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: authentik-provisioner
+  namespace: dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: authentik-provisioner
+subjects:
+- kind: ServiceAccount
+  name: authentik-provisioner
+  namespace: iam
+```
+
+### 3. Add Homarr Application to ArgoCD
+**File:** `k8s/argocd/apps/60-applications.yaml`
+**Location:** Add at the end (before the final `---`):
+
+```yaml
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: homarr
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "8"
+spec:
+  project: homelab
+  sources:
+    - repoURL: https://homarr-labs.github.io/charts
+      chart: homarr
+      targetRevision: "*"
+      helm:
+        valueFiles:
+          - $values/k8s/applications/homarr/homarr-values.yaml
+    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dashboard
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+```
+
+### 4. Add Ingress Rule
+**File:** `k8s/bootstrap/ingress/ingress.yaml`
+**Location:** In the `rules:` list, add:
+
+```yaml
+  - host: homarr.riotpiao.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: homarr
+            port:
+              number: 3000
+```
+
+### 5. Add CoreDNS Rewrite
+**File:** `k8s/bootstrap/coredns/coredns-configmap.yaml`
+**Location:** In the `rewrite name` section, add:
+
+```
+        rewrite name homarr.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+```
+
+## Verification Steps
+
+After committing and pushing all changes:
+
+1. Wait for ArgoCD to sync iam-jobs (authentik-provision runs)
+2. Check Authentik: `kubectl -n iam port-forward svc/authentik-server 9000:9000`
+   - Visit http://localhost:9000, login as rock
+   - Should see "Homarr" tile in application launcher
+3. Wait for homarr Application to sync
+4. Check pod: `kubectl -n dashboard get pods`
+5. Test SSO: https://homarr.riotpiao.com
+   - Should redirect to Authentik login
+   - Login as rock → should land logged-in to Homarr dashboard
+
+## Chart Info
+
+Homarr uses the official chart from https://homarr-labs.github.io/charts
+- Chart name: `homarr`
+- Pinned image: `ghcr.io/homarr-labs/homarr:1.0.0`
+- Persistence: 5Gi RWO on longhorn-wffc (3-replica HA)
+- Tile content is UI-managed (saved to PVC, not git)
+