diff --git a/kubernetes/apps/authentik/freeradius-config.yaml b/kubernetes/apps/authentik/freeradius-config.yaml
index 6ef47a6c..97266375 100644
--- a/kubernetes/apps/authentik/freeradius-config.yaml
+++ b/kubernetes/apps/authentik/freeradius-config.yaml
@@ -7,6 +7,9 @@ kind: ConfigMap
 metadata:
   name: freeradius-config
   namespace: authentik
+  annotations:
+    # FreeRADIUS uses ${...} itself; Flux postBuild substitution must skip it.
+    kustomize.toolkit.fluxcd.io/substitute: disabled
 data:
   radiusd.conf: |
     prefix = /opt