diff --git a/k8s/infra/logging/grafana-values.yaml b/k8s/infra/logging/grafana-values.yaml
index 578bd24..c27e4f2 100644
--- a/k8s/infra/logging/grafana-values.yaml
+++ b/k8s/infra/logging/grafana-values.yaml
@@ -68,9 +68,8 @@ grafana.ini:
   # doesn't return localhost redirects in its token responses.
   #
   # role_attribute_path: JMESPath expression evaluated against the userinfo
-  # response. Members of the 'grafana-admins' Authentik group get Admin role;
-  # everyone else gets Viewer. The group name must match exactly what Authentik
-  # sends in the 'groups' claim.
+  # response. akadmin gets GrafanaAdmin (server admin, can impersonate);
+  # homelab-admins members get Admin (org admin); everyone else Viewer.
   auth.generic_oauth:
     enabled: true
     name: Authentik
@@ -87,7 +86,7 @@ grafana.ini:
     email_attribute_path: email
     login_attribute_path: preferred_username
     name_attribute_path: name
-    role_attribute_path: "contains(groups[*], 'homelab-admins') && 'GrafanaAdmin' || 'Viewer'"
+    role_attribute_path: "preferred_username == 'akadmin' && 'GrafanaAdmin' || contains(groups[*], 'homelab-admins') && 'Admin' || 'Viewer'"
     allow_assign_grafana_admin: true
     use_pkce: false
     use_refresh_token: false