diff --git a/k8s/argocd/secrets/kustomization.yaml b/k8s/argocd/secrets/kustomization.yaml
index fbb5c71..0620574 100644
--- a/k8s/argocd/secrets/kustomization.yaml
+++ b/k8s/argocd/secrets/kustomization.yaml
@@ -1,9 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-secretGenerator:
-  - name: portfolio-secrets
-    namespace: portfolio
-    disableNameSuffixHash: true
-    envs:
-      - portfolio-secrets.enc.env
+# Disable hash suffix for all generated secrets (stable names)
+generatorOptions:
+  disableNameSuffixHash: true
+
+# SOPS-encrypted secrets via ksops generator
+generators:
+  - secret-generator.yaml
diff --git a/k8s/infra/iam/authentik-provision-job.yaml b/k8s/infra/iam/authentik-provision-job.yaml
index 7f3da6e..7ac2720 100644
--- a/k8s/infra/iam/authentik-provision-job.yaml
+++ b/k8s/infra/iam/authentik-provision-job.yaml
@@ -143,6 +143,48 @@ roleRef:
   name: authentik-provisioner
   apiGroup: rbac.authorization.k8s.io
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: authentik-provisioner
+  namespace: portfolio
+subjects:
+  - kind: ServiceAccount
+    name: authentik-provisioner
+    namespace: iam
+roleRef:
+  kind: ClusterRole
+  name: authentik-provisioner
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: authentik-provisioner
+  namespace: poimen
+subjects:
+  - kind: ServiceAccount
+    name: authentik-provisioner
+    namespace: iam
+roleRef:
+  kind: ClusterRole
+  name: authentik-provisioner
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: authentik-provisioner
+  namespace: dashboard
+subjects:
+  - kind: ServiceAccount
+    name: authentik-provisioner
+    namespace: iam
+roleRef:
+  kind: ClusterRole
+  name: authentik-provisioner
+  apiGroup: rbac.authorization.k8s.io
+---
 apiVersion: batch/v1
 kind: Job
 metadata: