diff --git a/k8s/bootstrap/phase4-argocd/argocd-values.yaml b/k8s/bootstrap/phase4-argocd/argocd-values.yaml
index ea13c86..a8b7bc4 100644
--- a/k8s/bootstrap/phase4-argocd/argocd-values.yaml
+++ b/k8s/bootstrap/phase4-argocd/argocd-values.yaml
@@ -131,12 +131,39 @@ configs:
     application.instanceLabelKey: argocd.argoproj.io/instance
     # Let every kustomize build run the ksops exec generator.
     kustomize.buildOptions: --enable-alpha-plugins --enable-exec
-    
+    # External URL — required so OIDC redirect URIs are built correctly.
+    url: https://argocd.riotpiao.com
+    # Local accounts (in addition to Authentik SSO):
+    #   rock  — human admin; can log in with a password AND issue API tokens.
+    #   cicd  — automation-only; apiKey (token) for the CD pipeline, no UI login.
+    accounts.rock: apiKey,login
+    accounts.cicd: apiKey
+    # Authentik OIDC. clientSecret pulled from the argocd `oidc-secret` Secret
+    # (created by authentik-provision). The groups claim drives RBAC below.
+    oidc.config: |
+      name: Authentik
+      issuer: https://authentik.riotpiao.com/application/o/argocd/
+      clientID: argocd
+      clientSecret: $oidc-secret:client-secret
+      requestedScopes:
+        - openid
+        - profile
+        - email
+        - groups
+      requestedIDTokenClaims:
+        groups:
+          essential: true
+
   params:
     server.insecure: false
 
-  # RBAC (allow admin full access)
+  # RBAC. local `admin` + `rock` + the `cicd` pipeline account all get role:admin;
+  # the Authentik `homelab-admins` group (rock is a member) maps to admin so SSO
+  # logins are admin too.
   rbac:
     policy.default: role:readonly
     policy.csv: |
       g, admin, role:admin
+      g, rock, role:admin
+      g, cicd, role:admin
+      g, homelab-admins, role:admin