diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml
index 5d60a4d2..9fdef09b 100644
--- a/kubernetes/apps/authentik/blueprints-configmap.yaml
+++ b/kubernetes/apps/authentik/blueprints-configmap.yaml
@@ -705,8 +705,9 @@ data:
             # AND (&(sambaDomainName=...)(objectClass=sambaDomain))
             # return entries instead of short-circuiting. Built from
             # the samba-bridge repo at
-            # gitea.renner.uno/konairius/authentik-samba-bridge .
-            container_image: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost:2026-10-28-0655
+            # gitea.renner.uno/konairius/authentik-samba-bridge ; Flux
+            # substitutes the image from clusters/homelab/authentik.yaml.
+            container_image: ${SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE}
             object_naming_template: "ak-outpost-%(name)s"
             kubernetes_namespace: authentik
             kubernetes_replicas: 1
diff --git a/kubernetes/apps/authentik/helmrelease.yaml b/kubernetes/apps/authentik/helmrelease.yaml
index 98069163..dcb80362 100644
--- a/kubernetes/apps/authentik/helmrelease.yaml
+++ b/kubernetes/apps/authentik/helmrelease.yaml
@@ -92,10 +92,6 @@ spec:
             secretKeyRef:
               name: ldap-outpost-tls
               key: tls.key
-        # Patched LDAP outpost image, set via `!Env` in the k8s-outposts
-        # blueprint (blueprints-configmap.yaml).
-        - name: SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE
-          value: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost:2026-10-28-0655 # {"$imagepolicy": "flux-system:authentik-samba-bridge-ldap-outpost"}
         # Key of the authentik-gate-sync API token, set via `!Env` in the
         # gate-sync blueprint (gate-sync.yaml).
         - name: AUTHENTIK_GATE_SYNC_TOKEN
diff --git a/kubernetes/clusters/homelab/authentik.yaml b/kubernetes/clusters/homelab/authentik.yaml
index b197270a..8c6a3fe8 100644
--- a/kubernetes/clusters/homelab/authentik.yaml
+++ b/kubernetes/clusters/homelab/authentik.yaml
@@ -16,6 +16,11 @@ spec:
   path: ./kubernetes/apps/authentik
   prune: true
   wait: true
+  # Substitutes every ${VAR} under kubernetes/apps/authentik; that path has
+  # no other ${...} literals. Flux image automation keeps the tag current.
+  postBuild:
+    substitute:
+      SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost:2026-10-28-0655 # {"$imagepolicy": "flux-system:authentik-samba-bridge-ldap-outpost"}
   # decryption block dropped 2026-07-14: path is sops-free — secrets come
   # from OpenBao via ESO (MIGRATION-sops-openbao.md). This was the LAST
   # sops consumer; phase 4 (age-key retirement) may proceed after soak.