diff --git a/k8s/infra/minio/minio-tenant.yaml b/k8s/infra/minio/minio-tenant.yaml
index b4dcbbf..28f6a21 100644
--- a/k8s/infra/minio/minio-tenant.yaml
+++ b/k8s/infra/minio/minio-tenant.yaml
@@ -96,9 +96,11 @@ spec:
       console: https://minio.riotpiao.com
 
   # ── OIDC via Authentik (server-side env, valid in v2 schema) ────────────────
+  # Use in-cluster URL for config fetch (pod→authentik); browser redirects use
+  # public URLs embedded in the OIDC metadata response (issuer stays public).
   env:
     - name: MINIO_IDENTITY_OPENID_CONFIG_URL
-      value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
+      value: "http://authentik-server.iam.svc.cluster.local/application/o/minio/.well-known/openid-configuration"
     - name: MINIO_IDENTITY_OPENID_CLIENT_ID
       value: "minio"
     - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET