diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml
index 5a1bfd40..b07cad07 100644
--- a/kubernetes/apps/authentik/blueprints-configmap.yaml
+++ b/kubernetes/apps/authentik/blueprints-configmap.yaml
@@ -257,17 +257,18 @@ data:
         attrs:
           is_superuser: false
 
-      # Distinct base DN — the outpost dispatches binds to the provider
-      # whose base_dn is a suffix of the bind DN. The pre-existing LDAP
-      # Unifi / LDAP Jellyfin providers BOTH use `DC=authentik,DC=renner,
-      # DC=uno`; with identical base DNs the first match wins for every
-      # bind, so attaching a third provider with the same base DN would
-      # never receive any binds (binds would land on whichever provider
-      # the outpost happens to order first and get policy-denied against
-      # the wrong Application). Scoping Synology under its own subtree
-      # both routes binds correctly and leaves the existing providers
-      # untouched — a focused fix that doesn't drag Unifi/Jellyfin into
-      # this change.
+      # SIBLING base DN, not a child of DC=authentik,DC=renner,DC=uno.
+      # The LDAP outpost dispatches with HasSuffixNoCase(bindDN, baseDN)
+      # and returns on the first iterated provider whose base_dn is a
+      # suffix — no longest-match preference. The pre-existing LDAP
+      # Unifi / LDAP Jellyfin providers both use DC=authentik,DC=renner,
+      # DC=uno and have lower provider IDs, so anything under that
+      # subtree (including a would-be child like DC=synology,DC=authentik,
+      # DC=renner,DC=uno) gets routed to whichever of those iterates
+      # first (Jellyfin in this cluster) and fails Jellyfin's policy.
+      # Using a sibling subtree under DC=renner,DC=uno avoids the
+      # collision entirely. Unifi/Jellyfin are left alone — their
+      # duplicate-base-DN is dormant config that does not affect Synology.
       - id: ldap-synology-provider
         model: authentik_providers_ldap.ldapprovider
         identifiers:
@@ -276,7 +277,7 @@ data:
         attrs:
           authorization_flow: !Find [authentik_flows.flow, [slug, ldap-authentication-flow]]
           invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
-          base_dn: DC=synology,DC=authentik,DC=renner,DC=uno
+          base_dn: DC=synology,DC=renner,DC=uno
           bind_mode: direct
           search_mode: direct
           uid_start_number: 2000