diff --git a/authentik/blueprint-scouting.yaml b/authentik/blueprint-scouting.yaml
index e10b40a..2c392b5 100644
--- a/authentik/blueprint-scouting.yaml
+++ b/authentik/blueprint-scouting.yaml
@@ -94,6 +94,16 @@ data:
           target: !KeyOf immich-app
         attrs:
           group: !KeyOf mbg-leden
+      # auth.scoutingmbg.nl: straight to Scouts Online, then on to the
+      # photos. Other domains keep the default brand.
+      - model: authentik_brands.brand
+        state: present
+        identifiers:
+          domain: auth.scoutingmbg.nl
+        attrs:
+          branding_title: Scouting MBG
+          flow_authentication: !Find [authentik_flows.flow, [slug, scouts-online-login]]
+          default_application: !KeyOf immich-app
       - model: authentik_policies.policybinding
         state: present
         identifiers:
@@ -220,7 +230,8 @@ data:
           policy: !KeyOf sso-only
       # SOL only lets in members of the organisations picked in its
       # connection, and only sends roles within them. The callback URL is
-      # https://authentik.rubenhensen.nl/source/oauth/callback/scouts-online/
+      # https://auth.scoutingmbg.nl/source/oauth/callback/scouts-online/ (and
+      # authentik.rubenhensen.nl, from before auth.scoutingmbg.nl existed)
       - model: authentik_sources_oauth.oauthsource
         id: source
         state: present
diff --git a/authentik/httproute.yaml b/authentik/httproute.yaml
index 4105e83..ead08c1 100644
--- a/authentik/httproute.yaml
+++ b/authentik/httproute.yaml
@@ -7,8 +7,12 @@ spec:
   - name: homelab
     namespace: envoy-gateway-system
     sectionName: https-authentik
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-auth-scoutingmbg
   hostnames:
   - authentik.rubenhensen.nl
+  - auth.scoutingmbg.nl
   rules:
   - backendRefs:
     - name: authentik-server
@@ -32,3 +36,6 @@ spec:
   - group: ""
     kind: Secret
     name: authentik-tls
+  - group: ""
+    kind: Secret
+    name: auth-scoutingmbg-tls
diff --git a/gateway/gateway.yaml b/gateway/gateway.yaml
index cd3321c..3b483be 100644
--- a/gateway/gateway.yaml
+++ b/gateway/gateway.yaml
@@ -58,6 +58,20 @@ spec:
         selector:
           matchLabels:
             kubernetes.io/metadata.name: authentik
+  - name: https-auth-scoutingmbg
+    protocol: HTTPS
+    port: 443
+    hostname: auth.scoutingmbg.nl
+    tls:
+      certificateRefs:
+      - name: auth-scoutingmbg-tls
+        namespace: authentik
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: authentik
   - name: https-vic
     protocol: HTTPS
     port: 443