diff --git a/k8s/infra/minio/minio-tenant.yaml b/k8s/infra/minio/minio-tenant.yaml
index 190d0de..9a06d68 100644
--- a/k8s/infra/minio/minio-tenant.yaml
+++ b/k8s/infra/minio/minio-tenant.yaml
@@ -83,11 +83,16 @@ spec:
   # 'default' and fail the reconcile).
 
   # Public hostnames the tenant serves (S3 + console via the cluster ingress).
+  # Must match actual ingress backends: the "minio" Ingress (host
+  # minio.riotpiao.com) routes to minio-cluster-console:9090, and "minio-api"
+  # (host minio-api.riotpiao.com) routes to minio:9000. Previously these were
+  # swapped, so MinIO's own console-domain validation rejected the OIDC
+  # callback arriving on minio.riotpiao.com's Host header.
   features:
     domains:
       minio:
-        - https://minio.riotpiao.com
-      console: https://minio-console.riotpiao.com
+        - https://minio-api.riotpiao.com
+      console: https://minio.riotpiao.com
 
   # ── OIDC via Authentik (server-side env, valid in v2 schema) ────────────────
   env: