diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml
index 21973996..5a1bfd40 100644
--- a/kubernetes/apps/authentik/blueprints-configmap.yaml
+++ b/kubernetes/apps/authentik/blueprints-configmap.yaml
@@ -257,6 +257,17 @@ data:
         attrs:
           is_superuser: false
 
+      # Distinct base DN — the outpost dispatches binds to the provider
+      # whose base_dn is a suffix of the bind DN. The pre-existing LDAP
+      # Unifi / LDAP Jellyfin providers BOTH use `DC=authentik,DC=renner,
+      # DC=uno`; with identical base DNs the first match wins for every
+      # bind, so attaching a third provider with the same base DN would
+      # never receive any binds (binds would land on whichever provider
+      # the outpost happens to order first and get policy-denied against
+      # the wrong Application). Scoping Synology under its own subtree
+      # both routes binds correctly and leaves the existing providers
+      # untouched — a focused fix that doesn't drag Unifi/Jellyfin into
+      # this change.
       - id: ldap-synology-provider
         model: authentik_providers_ldap.ldapprovider
         identifiers:
@@ -265,7 +276,7 @@ data:
         attrs:
           authorization_flow: !Find [authentik_flows.flow, [slug, ldap-authentication-flow]]
           invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
-          base_dn: DC=authentik,DC=renner,DC=uno
+          base_dn: DC=synology,DC=authentik,DC=renner,DC=uno
           bind_mode: direct
           search_mode: direct
           uid_start_number: 2000