diff --git a/authentik/blueprint-actualbudget-proxy.yaml b/authentik/blueprint-actualbudget-proxy.yaml
index 410d764..cd526f5 100644
--- a/authentik/blueprint-actualbudget-proxy.yaml
+++ b/authentik/blueprint-actualbudget-proxy.yaml
@@ -38,3 +38,12 @@ data:
           name: Actual Budget
           provider: !KeyOf actualbudget-provider
           meta_launch_url: https://ynab.rubenhensen.nl
+      # Only admins: Scouts Online members get accounts in this authentik
+      # too (for immich) and must not reach personal apps.
+      - model: authentik_policies.policybinding
+        state: present
+        identifiers:
+          order: 0
+          target: !KeyOf actualbudget-app
+        attrs:
+          group: !Find [authentik_core.group, [name, "authentik Admins"]]
diff --git a/authentik/blueprint-argocd-oidc.yaml b/authentik/blueprint-argocd-oidc.yaml
index 61a0bed..2c5486e 100644
--- a/authentik/blueprint-argocd-oidc.yaml
+++ b/authentik/blueprint-argocd-oidc.yaml
@@ -38,3 +38,12 @@ data:
           name: ArgoCD
           provider: !KeyOf argocd-provider
           meta_launch_url: https://argocd.rubenhensen.nl
+      # Only admins: Scouts Online members get accounts in this authentik
+      # too (for immich) and must not reach personal apps.
+      - model: authentik_policies.policybinding
+        state: present
+        identifiers:
+          order: 0
+          target: !KeyOf argocd-app
+        attrs:
+          group: !Find [authentik_core.group, [name, "authentik Admins"]]
diff --git a/authentik/blueprint-freshrss-oidc.yaml b/authentik/blueprint-freshrss-oidc.yaml
index 9c47ea3..65b88f7 100644
--- a/authentik/blueprint-freshrss-oidc.yaml
+++ b/authentik/blueprint-freshrss-oidc.yaml
@@ -40,3 +40,12 @@ data:
           name: FreshRSS
           provider: !KeyOf freshrss-provider
           meta_launch_url: https://rss.rubenhensen.nl
+      # Only admins: Scouts Online members get accounts in this authentik
+      # too (for immich) and must not reach personal apps.
+      - model: authentik_policies.policybinding
+        state: present
+        identifiers:
+          order: 0
+          target: !KeyOf freshrss-app
+        attrs:
+          group: !Find [authentik_core.group, [name, "authentik Admins"]]
diff --git a/authentik/blueprint-mail-oidc.yaml b/authentik/blueprint-mail-oidc.yaml
index 1fe82b4..468a429 100644
--- a/authentik/blueprint-mail-oidc.yaml
+++ b/authentik/blueprint-mail-oidc.yaml
@@ -38,3 +38,12 @@ data:
           name: Stalwart Mail
           provider: !KeyOf stalwart-provider
           meta_launch_url: https://mail.rubenhensen.nl
+      # Only admins: Scouts Online members get accounts in this authentik
+      # too (for immich) and must not reach personal apps.
+      - model: authentik_policies.policybinding
+        state: present
+        identifiers:
+          order: 0
+          target: !KeyOf stalwart-app
+        attrs:
+          group: !Find [authentik_core.group, [name, "authentik Admins"]]
diff --git a/authentik/blueprint-vault-oidc.yaml b/authentik/blueprint-vault-oidc.yaml
index dcdd204..93c4411 100644
--- a/authentik/blueprint-vault-oidc.yaml
+++ b/authentik/blueprint-vault-oidc.yaml
@@ -40,3 +40,12 @@ data:
           name: Vault
           provider: !KeyOf vault-provider
           meta_launch_url: https://vault.rubenhensen.nl
+      # Only admins: Scouts Online members get accounts in this authentik
+      # too (for immich) and must not reach personal apps.
+      - model: authentik_policies.policybinding
+        state: present
+        identifiers:
+          order: 0
+          target: !KeyOf vault-app
+        attrs:
+          group: !Find [authentik_core.group, [name, "authentik Admins"]]