diff --git a/k8s/infra/logging/grafana-values.yaml b/k8s/infra/logging/grafana-values.yaml
index 634fa2f..59dc0e8 100644
--- a/k8s/infra/logging/grafana-values.yaml
+++ b/k8s/infra/logging/grafana-values.yaml
@@ -76,6 +76,13 @@ grafana.ini:
     auth_url: https://authentik.riotpiao.com/application/o/authorize/
     token_url: https://authentik.riotpiao.com/application/o/token/
     api_url: https://authentik.riotpiao.com/application/o/userinfo/
+    # Read identity straight from the userinfo/id_token claims. Without these,
+    # Grafana falls back to the GitHub-style "<api_url>/emails" call, which
+    # Authentik doesn't serve — request 404s with "Error getting email address"
+    # and the whole OAuth login fails.
+    email_attribute_path: email
+    login_attribute_path: preferred_username
+    name_attribute_path: name
     role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'"
     use_pkce: false
     use_refresh_token: false