diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml
index c9934055..9ee16e51 100644
--- a/kubernetes/apps/authentik/blueprints-configmap.yaml
+++ b/kubernetes/apps/authentik/blueprints-configmap.yaml
@@ -32,12 +32,37 @@ data:
         attrs:
           service_connection: !KeyOf k8s-conn
 
+      # `Caddy` and `Local Radius` carried `kubernetes_namespace: default`
+      # in their config from the Proxmox-era data, which the chart Role
+      # has no permissions for. Pin both at `authentik` so the worker
+      # spawns them next to authentik-server; the Role already grants
+      # the deploy/svc/ingress/secret/configmap perms in this namespace.
+      # The `LDAP Outpost` config never had `kubernetes_namespace` set,
+      # so it defaults to the running pod's namespace and is fine — but
+      # we still pin its service_connection here for symmetry.
       - model: authentik_outposts.outpost
         identifiers:
           name: Caddy
         state: present
         attrs:
           service_connection: !KeyOf k8s-conn
+          config:
+            log_level: info
+            authentik_host: "https://auth.renner.uno/"
+            authentik_host_insecure: false
+            authentik_host_browser: ""
+            refresh_interval: "minutes=5"
+            container_image: null
+            object_naming_template: "ak-outpost-%(name)s"
+            kubernetes_namespace: authentik
+            kubernetes_replicas: 1
+            kubernetes_service_type: ClusterIP
+            kubernetes_disabled_components: []
+            kubernetes_image_pull_secrets: []
+            kubernetes_ingress_annotations: {}
+            kubernetes_ingress_class_name: null
+            kubernetes_ingress_secret_name: "authentik-outpost-tls"
+            kubernetes_json_patches: null
 
       - model: authentik_outposts.outpost
         identifiers:
@@ -52,6 +77,26 @@ data:
         state: present
         attrs:
           service_connection: !KeyOf k8s-conn
+          config:
+            log_level: info
+            authentik_host: "https://auth.renner.uno/"
+            authentik_host_insecure: false
+            authentik_host_browser: ""
+            refresh_interval: "minutes=5"
+            container_image: null
+            object_naming_template: "ak-outpost-%(name)s"
+            kubernetes_namespace: authentik
+            kubernetes_replicas: 1
+            kubernetes_service_type: ClusterIP
+            kubernetes_disabled_components: []
+            kubernetes_image_pull_secrets: []
+            kubernetes_ingress_annotations: {}
+            kubernetes_ingress_class_name: null
+            kubernetes_ingress_secret_name: "authentik-outpost-tls"
+            kubernetes_ingress_path_type: null
+            kubernetes_httproute_annotations: {}
+            kubernetes_httproute_parent_refs: []
+            kubernetes_json_patches: null
 
       - model: authentik_outposts.dockerserviceconnection
         identifiers: