diff --git a/k8s/infra/minio/minio-tenant.yaml b/k8s/infra/minio/minio-tenant.yaml
index 28f6a21..31a8255 100644
--- a/k8s/infra/minio/minio-tenant.yaml
+++ b/k8s/infra/minio/minio-tenant.yaml
@@ -100,7 +100,10 @@ spec:
   # public URLs embedded in the OIDC metadata response (issuer stays public).
   env:
     - name: MINIO_IDENTITY_OPENID_CONFIG_URL
-      value: "http://authentik-server.iam.svc.cluster.local/application/o/minio/.well-known/openid-configuration"
+      # Must use external URL — well-known response contains external issuer/jwks_uri.
+      # MinIO validates issuer in JWT matches well-known issuer. Internal URL = mismatch.
+      # Hairpins through ingress-nginx but stays in-cluster.
+      value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
     - name: MINIO_IDENTITY_OPENID_CLIENT_ID
       value: "minio"
     - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET