diff --git a/actual-budget/external-secret.yaml b/actual-budget/external-secret.yaml
new file mode 100644
index 0000000..e819ef3
--- /dev/null
+++ b/actual-budget/external-secret.yaml
@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: actualbudget-oidc-client-secret
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: actualbudget-oidc-client-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: client_secret
+      remoteRef:
+        key: kv/actualbudget-oidc
+        property: client_secret
diff --git a/actual-budget/helm-actual-budget.yaml b/actual-budget/helm-actual-budget.yaml
index d0f8f07..ed35aba 100644
--- a/actual-budget/helm-actual-budget.yaml
+++ b/actual-budget/helm-actual-budget.yaml
@@ -21,6 +21,20 @@ spec:
         image:
           tag: "26.3.0"
 
+        # OIDC configuration
+        env:
+          - name: ACTUAL_OPENID_DISCOVERY_URL
+            value: https://authentik.rubenhensen.nl/application/o/actualbudget/
+          - name: ACTUAL_OPENID_CLIENT_ID
+            value: actualbudget
+          - name: ACTUAL_OPENID_CLIENT_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: actualbudget-oidc-client-secret
+                key: client_secret
+          - name: ACTUAL_OPENID_SERVER_HOSTNAME
+            value: https://ynab.rubenhensen.nl
+
         # Service configuration
         service:
           type: ClusterIP
@@ -33,14 +47,6 @@ spec:
           annotations:
             cert-manager.io/cluster-issuer: prod-cluster-issuer
             nginx.ingress.kubernetes.io/proxy-body-size: 50m
-            nginx.ingress.kubernetes.io/auth-url: |-
-              http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/nginx
-            nginx.ingress.kubernetes.io/auth-signin: |-
-              https://authentik.rubenhensen.nl/outpost.goauthentik.io/start?rd=$scheme%3A%2F%2F$host$escaped_request_uri
-            nginx.ingress.kubernetes.io/auth-response-headers: |-
-              Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-entitlements,X-authentik-email,X-authentik-name,X-authentik-uid
-            nginx.ingress.kubernetes.io/auth-snippet: |-
-              proxy_set_header X-Forwarded-Host $http_host;
           hosts:
             - host: ynab.rubenhensen.nl
               paths:
diff --git a/apps/templates/authentik-helm.yaml b/apps/templates/authentik-helm.yaml
index f2e89c2..3c440c4 100644
--- a/apps/templates/authentik-helm.yaml
+++ b/apps/templates/authentik-helm.yaml
@@ -81,6 +81,11 @@ spec:
                   secretKeyRef:
                     name: freshrss-oidc-client-secret
                     key: client_secret
+              - name: ACTUALBUDGET_OIDC_CLIENT_SECRET
+                valueFrom:
+                  secretKeyRef:
+                    name: actualbudget-oidc-client-secret
+                    key: client_secret
           server:
             volumes:
               - name: blueprint-vault
diff --git a/authentik/blueprint-actualbudget-proxy.yaml b/authentik/blueprint-actualbudget-proxy.yaml
index c9cba1b..410d764 100644
--- a/authentik/blueprint-actualbudget-proxy.yaml
+++ b/authentik/blueprint-actualbudget-proxy.yaml
@@ -6,9 +6,9 @@ data:
   actualbudget-proxy.yaml: |
     version: 1
     metadata:
-      name: Actual Budget Proxy
+      name: Actual Budget OIDC
     entries:
-      - model: authentik_providers_proxy.proxyprovider
+      - model: authentik_providers_oauth2.oauth2provider
         id: actualbudget-provider
         state: present
         identifiers:
@@ -18,8 +18,17 @@ data:
           authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
           authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
           invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          mode: forward_single
-          external_host: https://ynab.rubenhensen.nl
+          client_type: confidential
+          client_id: actualbudget
+          client_secret: !Env [ACTUALBUDGET_OIDC_CLIENT_SECRET, ""]
+          redirect_uris:
+            - matching_mode: strict
+              url: https://ynab.rubenhensen.nl/openid/callback
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
       - model: authentik_core.application
         id: actualbudget-app
         state: present
diff --git a/authentik/external-secret.yaml b/authentik/external-secret.yaml
index 9bfaf96..cb65e54 100644
--- a/authentik/external-secret.yaml
+++ b/authentik/external-secret.yaml
@@ -117,3 +117,21 @@ spec:
       remoteRef:
         key: kv/freshrss-oidc
         property: client_secret
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: actualbudget-oidc-client-secret
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: actualbudget-oidc-client-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: client_secret
+      remoteRef:
+        key: kv/actualbudget-oidc
+        property: client_secret