diff --git a/kubernetes/apps/authentik/wlan-setup-config.yaml b/kubernetes/apps/authentik/wlan-setup-config.yaml
index f611a227..8d8b52c4 100644
--- a/kubernetes/apps/authentik/wlan-setup-config.yaml
+++ b/kubernetes/apps/authentik/wlan-setup-config.yaml
@@ -175,6 +175,10 @@ data:
         location ~ ^/_ak(/.*)$ {
             internal;
             proxy_pass http://authentik$1;
+            # njs reads the whole reply from this buffer (default one page).
+            subrequest_output_buffer_size 256k;
+            # Only the headers set here reach authentik.
+            proxy_pass_request_headers off;
             proxy_set_header Host auth.renner.uno;
             proxy_set_header Cookie "";
             proxy_set_header Authorization "$arg_scheme $arg_cred";
@@ -324,7 +328,7 @@ data:
 
             const now = new Date();
             const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\..*$/, "");
-            const identifier = "wlan-android-" + user.replace(/[^A-Za-z0-9-]/g, "-").toLowerCase() + "-" + stamp;
+            const identifier = "wlan-android-" + user.replace(/[^A-Za-z0-9-]/g, "-").toLowerCase() + "-" + stamp + "-" + random().substring(0, 6).replace(/[^A-Za-z0-9]/g, "x");
             const expires = new Date(now.getTime() + LIFETIME_DAYS * 86400000).toISOString();
             await ak(r, "POST", "/api/v3/core/tokens/", "Bearer", access, JSON_CT, JSON.stringify({
                 identifier: identifier,