diff --git a/k8s/applications/homarr/homarr-values.yaml b/k8s/applications/homarr/homarr-values.yaml
index 18fb44a..4535cc2 100644
--- a/k8s/applications/homarr/homarr-values.yaml
+++ b/k8s/applications/homarr/homarr-values.yaml
@@ -1,4 +1,4 @@
-# Homarr landing page - minimal config
+# Homarr landing page with Authentik SSO
 # Probes patched via PostSync hook (chart doesn't support customization)
 
 image:
@@ -8,6 +8,32 @@ image:
 
 replicaCount: 1
 
+# Configure SSO via environment variables
+# Chart supports these via top-level env dict (not array)
+env:
+  AUTH_PROVIDERS: "oidc,credentials"
+  AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
+  AUTH_OIDC_CLIENT_NAME: "Authentik"
+  AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
+  AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
+  AUTH_OIDC_AUTO_LOGIN: "false"
+  BASE_URL: "https://homarr.riotpiao.com"
+  NEXTAUTH_URL: "https://homarr.riotpiao.com"
+
+# Client credentials from homarr-oidc secret
+# Chart doesn't support envFrom, so we add via extraEnv
+extraEnv:
+  - name: AUTH_OIDC_CLIENT_ID
+    valueFrom:
+      secretKeyRef:
+        name: homarr-oidc
+        key: client-id
+  - name: AUTH_OIDC_CLIENT_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: homarr-oidc
+        key: client-secret
+
 tolerations:
   - key: node-role.kubernetes.io/control-plane
     operator: Exists