diff --git a/.forgejo/workflows/terraform-apply.yml b/.forgejo/workflows/terraform-apply.yml
index 089b6e5..6973fd5 100644
--- a/.forgejo/workflows/terraform-apply.yml
+++ b/.forgejo/workflows/terraform-apply.yml
@@ -80,8 +80,6 @@ jobs:
       - name: Terraform Init
         working-directory: terraform
         env:
-          # MinIO S3 backend — use internal DNS (storage ns) instead of external hostname
-          # Runner pod blocked from external DNS; internal DNS is routable
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           TF_VAR_kubeconfig_path: /tmp/kubeconfig
@@ -89,9 +87,15 @@ jobs:
           TF_SKIP_REGION_VALIDATION: "true"
           TF_SKIP_REQUESTING_ACCOUNT_ID: "true"
         run: |
-          # Override S3 endpoint to use internal cluster DNS
-          export TF_CLI_ARGS_init="-backend-config=endpoints.s3=http://minio.storage.svc.cluster.local:9000"
-          terraform init
+          terraform init \
+            -backend-config="bucket=terraform-state" \
+            -backend-config="key=homelab/terraform.tfstate" \
+            -backend-config="region=us-east-1" \
+            -backend-config="endpoint=http://minio.storage.svc.cluster.local:9000" \
+            -backend-config="access_key=$AWS_ACCESS_KEY_ID" \
+            -backend-config="secret_key=$AWS_SECRET_ACCESS_KEY" \
+            -backend-config="skip_credentials_validation=true" \
+            -backend-config="use_path_style=true"
 
       - name: Pull Terraform State
         working-directory: terraform
diff --git a/terraform/authentik-generated.tf b/terraform/authentik-generated.tf
index 49e4d1a..a13c9b8 100644
--- a/terraform/authentik-generated.tf
+++ b/terraform/authentik-generated.tf
@@ -25,7 +25,7 @@ resource "authentik_group" "authentik_admins" {
   name         = "authentik Admins"
   parent       = null
   roles        = null
-  users        = [5, 4]
+  users        = [5, 4, 38]
 }
 
 # __generated__ by Terraform from "5"
@@ -137,7 +137,7 @@ resource "authentik_application" "core_cli_app" {
   name                  = "core-cli"
   open_in_new_tab       = false
   policy_engine_mode    = "any"
-  protocol_provider     = 0
+  protocol_provider     = authentik_provider_oauth2.core_cli_provider.id
   slug                  = "core-cli"
   uuid                  = "f15c69b4-414b-49da-9e65-eef0a0dbf1ee"
 }
diff --git a/terraform/state.tf b/terraform/state.tf
index b83ef23..01c336f 100644
--- a/terraform/state.tf
+++ b/terraform/state.tf
@@ -4,10 +4,7 @@ terraform {
     bucket                      = "terraform-state"
     key                         = "homelab/terraform.tfstate"
     region                      = "us-east-1"
-    endpoints = {
-      s3 = "https://minio-api.riotpiao.homelab.com"
-    }
-    profile                     = "minio"
+    endpoint                    = "https://minio-api.riotpiao.homelab.com"
     skip_credentials_validation = true
     skip_requesting_account_id  = true
     skip_region_validation      = true