diff --git a/k8s/security/iam/kustomization.yaml b/k8s/security/iam/kustomization.yaml
index c97aed2..833d917 100644
--- a/k8s/security/iam/kustomization.yaml
+++ b/k8s/security/iam/kustomization.yaml
@@ -1,8 +1,19 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: iam
+# NOTE: no top-level `namespace:` transformer here (removed) - it used to
+# force-rewrite metadata.namespace to "iam" on every resource in this
+# kustomization, which was harmless while every manifest here only ever
+# targeted the iam namespace itself. authentik-provision-job.yaml's
+# RoleBindings deliberately target cicd/argocd/logging/storage (least-
+# privilege access for the authentik-provisioner ServiceAccount to touch
+# Secrets in those namespaces) - the namespace transformer would have
+# silently rewritten all of them back to iam, breaking the RBAC. Every
+# manifest in this directory already sets its own explicit
+# metadata.namespace, so dropping the transformer changes nothing for the
+# existing resources/.
 resources:
   - key-rotation-cronjob.yaml
+  - authentik-provision-job.yaml
 # authentik-migrations-job.yaml removed — redundant + broken. The authentik
 # `server` entrypoint runs migrations itself; this standalone job lacked the
 # authentik-secrets envFrom (Secret key missing) and always failed.