diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml
index ce248410..8ce078d6 100644
--- a/kubernetes/apps/authentik/blueprints-configmap.yaml
+++ b/kubernetes/apps/authentik/blueprints-configmap.yaml
@@ -188,18 +188,12 @@ data:
         state: present
         attrs:
           service_connection: !KeyOf k8s-conn
-          # The gate's ProxyProvider is also attached here so the
-          # embedded outpost (running inside authentik-server, served
-          # at auth.renner.uno) handles the browser-facing legs of the
-          # forward-auth flow: /outpost.goauthentik.io/start, the
-          # /application/o/authorize hop, the /if/flow login UI (with
-          # WebAuthn/2FA bound to auth.renner.uno), and the OAuth
-          # /outpost.goauthentik.io/callback. The cookie issued from
-          # auth.renner.uno is scoped to renner.uno so the dedicated
-          # paperless-gate outpost picks it up on its in-cluster
-          # /auth/nginx checks.
-          providers:
-            - !KeyOf paperless-gate-provider
+          # No providers attached — the dedicated paperless-gate outpost
+          # owns its own /outpost.goauthentik.io/* path on auth.renner.uno
+          # via the paperless-gate-ingress.yaml Ingress, so it sees
+          # /start, /callback, AND /auth/nginx in the same process and
+          # keeps a single session store for the gate's flow.
+          providers: []
 
       # `Caddy` and `Local Radius` carried `kubernetes_namespace: default`
       # in their config from the Proxmox-era data, which the chart Role
diff --git a/kubernetes/apps/authentik/kustomization.yaml b/kubernetes/apps/authentik/kustomization.yaml
index 78ad238f..9014ab73 100644
--- a/kubernetes/apps/authentik/kustomization.yaml
+++ b/kubernetes/apps/authentik/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
   - secret.sops.yaml
   - blueprints-configmap.yaml
   - helmrelease.yaml
+  - paperless-gate-ingress.yaml
diff --git a/kubernetes/apps/authentik/paperless-gate-ingress.yaml b/kubernetes/apps/authentik/paperless-gate-ingress.yaml
new file mode 100644
index 00000000..d9c578ff
--- /dev/null
+++ b/kubernetes/apps/authentik/paperless-gate-ingress.yaml
@@ -0,0 +1,37 @@
+---
+# Routes auth.renner.uno/outpost.goauthentik.io/* to the dedicated
+# `paperless-gate` outpost. Without this rule, those paths hit the
+# Helm-managed authentik-server Ingress (catch-all `/`) which forwards
+# them to the embedded outpost — a separate process with its own
+# session store. The OAuth callback the embedded outpost handles never
+# materialises into a session the gate outpost can see, so the gate's
+# auth_request keeps returning 401 and the browser loops between
+# /authorize and /callback.
+#
+# nginx-ingress merges path rules across Ingress objects on the same
+# host and picks the most specific match, so this Ingress's
+# `/outpost.goauthentik.io` Prefix beats the chart's `/` rule.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: paperless-gate-outpost
+  namespace: authentik
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: auth.renner.uno
+      http:
+        paths:
+          - path: /outpost.goauthentik.io
+            pathType: Prefix
+            backend:
+              service:
+                name: ak-outpost-paperless-gate
+                port:
+                  number: 9000
+  tls:
+    - secretName: paperless-gate-outpost-tls
+      hosts:
+        - auth.renner.uno