diff --git a/k8s/infra/rbac/admin-oidc-binding.yaml b/k8s/infra/rbac/admin-oidc-binding.yaml
new file mode 100644
index 0000000..63b0de2
--- /dev/null
+++ b/k8s/infra/rbac/admin-oidc-binding.yaml
@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: homelab-admin-oidc
+spec:
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: ClusterRole
+    name: cluster-admin
+  subjects:
+    # OIDC group for Authentik homelab-admins members
+    # When rock logs in via OIDC, k8s sees:
+    # - User: oidc:rock@example.com
+    # - Groups: oidc:homelab-admins (from Authentik group claim)
+    - kind: Group
+      name: oidc:homelab-admins