diff --git a/apps/authentik/values.yaml b/apps/authentik/values.yaml
index ee17fbd..df79450 100644
--- a/apps/authentik/values.yaml
+++ b/apps/authentik/values.yaml
@@ -1,11 +1,112 @@
-# Migration safety switch. The first sync provisions only PostgreSQL, backups,
-# encrypted Secrets, and the /data volume. Set this to true only after the
-# source database and files have been restored.
+# The trial server is enabled only after the source database and files have
+# been restored. Its worker and Ingress remain disabled until cutover, which
+# prevents background jobs and production traffic reaching this clone.
 authentikDeployment:
-  enabled: false
+  enabled: true
 
-# Values below are passed to the upstream chart once the switch above is true.
 authentik:
+  global:
+    # CloudNativePG generates this connection Secret. Referencing individual
+    # keys avoids duplicating its generated database password in Git or SOPS.
+    env:
+      - name: AUTHENTIK_POSTGRESQL__HOST
+        valueFrom:
+          secretKeyRef:
+            name: authentik-postgres-app
+            key: host
+      - name: AUTHENTIK_POSTGRESQL__PORT
+        valueFrom:
+          secretKeyRef:
+            name: authentik-postgres-app
+            key: port
+      - name: AUTHENTIK_POSTGRESQL__NAME
+        valueFrom:
+          secretKeyRef:
+            name: authentik-postgres-app
+            key: dbname
+      - name: AUTHENTIK_POSTGRESQL__USER
+        valueFrom:
+          secretKeyRef:
+            name: authentik-postgres-app
+            key: username
+      - name: AUTHENTIK_POSTGRESQL__PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: authentik-postgres-app
+            key: password
+      # `require` encrypts traffic to PostgreSQL without depending on a public
+      # CA; CloudNativePG rotates its private in-cluster certificates itself.
+      - name: AUTHENTIK_POSTGRESQL__SSLMODE
+        value: require
+
+    # The same Longhorn claim carries three restored source directories. Each
+    # subPath is mounted where the upstream container expects it.
+    volumes:
+      - name: authentik-data
+        persistentVolumeClaim:
+          claimName: authentik-data
+    volumeMounts:
+      - name: authentik-data
+        mountPath: /data
+        subPath: data
+      - name: authentik-data
+        mountPath: /templates
+        subPath: custom-templates
+      - name: authentik-data
+        mountPath: /certs
+        subPath: certs
+
+  authentik:
+    # This SOPS-managed Secret contains the source installation's exact secret
+    # key, preserving encrypted configuration and existing identity semantics.
+    existingSecret:
+      secretName: authentik-secrets
+
   # CloudNativePG supplies PostgreSQL; do not deploy the bundled database.
   postgresql:
     enabled: false
+
+  server:
+    replicas: 1
+    # UID/GID 1000 matches the restored Docker files and satisfies this
+    # namespace's restricted Pod Security policy without running as root.
+    securityContext:
+      runAsNonRoot: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      fsGroup: 1000
+    containerSecurityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      seccompProfile:
+        type: RuntimeDefault
+    resources:
+      requests:
+        cpu: 250m
+        memory: 512Mi
+      limits:
+        cpu: "2"
+        memory: 2Gi
+    # Test through kubectl port-forward first. Ingress is enabled only after
+    # the clone is verified and the final source snapshot has been restored.
+    ingress:
+      enabled: false
+
+  worker:
+    # Workers run scheduled jobs, source synchronization, and other background
+    # tasks. Keep them off while the original VM remains authoritative.
+    replicas: 0
+    securityContext:
+      runAsNonRoot: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      fsGroup: 1000
+    containerSecurityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      seccompProfile:
+        type: RuntimeDefault