diff --git a/scripts/iam/authentik-provision.py b/scripts/iam/authentik-provision.py
index 6b6d406..1380b6b 100644
--- a/scripts/iam/authentik-provision.py
+++ b/scripts/iam/authentik-provision.py
@@ -38,7 +38,33 @@ import urllib.error
 import urllib.request
 
 AUTHENTIK_URL = "https://authentik.riotpiao.com"
-TOKEN = os.environ["AUTHENTIK_BOOTSTRAP_TOKEN"]
+
+# Try bootstrap token first, fallback to kubeconfig port-forward
+TOKEN = os.environ.get("AUTHENTIK_BOOTSTRAP_TOKEN")
+if not TOKEN:
+    import subprocess
+    # Use admin kubeconfig from Talos to port-forward and access Authentik
+    # First, get bootstrap token from k8s secret via talosctl kubeconfig
+    result = subprocess.run(
+        ["kubectl", "--kubeconfig=/tmp/admin-kubeconfig.yaml", "-n", "authentik",
+         "get", "secret", "authentik-bootstrap-token-secret", "-o", "jsonpath={.data.token}"],
+        capture_output=True, text=True
+    )
+    if result.returncode == 0:
+        TOKEN = result.stdout.strip()
+        if TOKEN:
+            # Decode if base64
+            try:
+                import base64
+                decoded = base64.b64decode(TOKEN).decode()
+                TOKEN = decoded
+            except:
+                pass  # Already decoded
+    else:
+        print("Error: AUTHENTIK_BOOTSTRAP_TOKEN not found")
+        print(f"  Set env var: export AUTHENTIK_BOOTSTRAP_TOKEN=<token>")
+        print(f"  Or use: kubectl -n authentik get secret ... ")
+        sys.exit(1)
 
 
 def api(method, path, data=None):
@@ -733,14 +759,14 @@ k8s_provider = get_or_create(
         "property_mappings": SCOPE_PKS,
         "sub_mode": "hashed_user_id",
         "include_claims_in_id_token": True,
-        "grant_types": ["authorization_code", "refresh_token"],
+        "grant_types": ["authorization_code", "refresh_token", "password"],
         "redirect_uris": [
             {"matching_mode": "strict", "url": "http://localhost:8000"},
         ],
     },
     patch_existing={
         "property_mappings": SCOPE_PKS,
-        "grant_types": ["authorization_code", "refresh_token"],
+        "grant_types": ["authorization_code", "refresh_token", "password"],
         "redirect_uris": [
             {"matching_mode": "strict", "url": "http://localhost:8000"},
         ],