diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml
index 868f5e36..e08981ab 100644
--- a/kubernetes/apps/authentik/blueprints-configmap.yaml
+++ b/kubernetes/apps/authentik/blueprints-configmap.yaml
@@ -803,3 +803,64 @@ data:
               matching_mode: strict
             - url: 'https://netbird\.renner\.uno(/.*)?'
               matching_mode: regex
+
+      - model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: Audiobookshelf
+        state: present
+        attrs:
+          authentication_flow: !KeyOf passkey-passwordless-flow
+          authorization_flow: !KeyOf passkey-stepup-flow
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: confidential
+          redirect_uris:
+            - url: https://audiobooks.renner.uno/auth/openid/callback
+              matching_mode: strict
+            - url: https://audiobooks.renner.uno/auth/openid/mobile-redirect
+              matching_mode: strict
+
+      - model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: immich-oauth-provider
+        state: present
+        attrs:
+          authentication_flow: !KeyOf passkey-passwordless-flow
+          authorization_flow: !KeyOf passkey-stepup-flow
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: confidential
+          redirect_uris:
+            - url: app.immich:///oauth-callback
+              matching_mode: strict
+            - url: https://immich.renner.uno/auth/login
+              matching_mode: strict
+            - url: https://immich.renner.uno/user-settings
+              matching_mode: strict
+
+      - model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: Provider for Gittea
+        state: present
+        attrs:
+          authentication_flow: !KeyOf passkey-passwordless-flow
+          authorization_flow: !KeyOf passkey-stepup-flow
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: confidential
+          redirect_uris:
+            - url: https://gitea.renner.uno/user/oauth2/authentik/callback
+              matching_mode: strict
+
+      # PVE, PBS and paperless-gate deliberately stay on the default
+      # implicit-consent flow (password + MFA) — passkey-only covers
+      # the daily-driver apps above.
+      - model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: Provider for Grafana
+        state: present
+        attrs:
+          authentication_flow: !KeyOf passkey-passwordless-flow
+          authorization_flow: !KeyOf passkey-stepup-flow
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: confidential
+          redirect_uris:
+            - url: https://dash.renner.uno/login/generic_oauth
+              matching_mode: strict