diff --git a/dns/domains/rubenhensen.nl.yaml b/dns/domains/rubenhensen.nl.yaml
index 65e47f5..f17d235 100644
--- a/dns/domains/rubenhensen.nl.yaml
+++ b/dns/domains/rubenhensen.nl.yaml
@@ -18,7 +18,7 @@ records:
   - name: "authentik"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "46.224.26.65"
   - name: "ldap"
     expire: 300
     type: A
diff --git a/nix-infra-machine/nodes/node001.nix b/nix-infra-machine/nodes/node001.nix
index fcb5738..2c8c7aa 100644
--- a/nix-infra-machine/nodes/node001.nix
+++ b/nix-infra-machine/nodes/node001.nix
@@ -53,8 +53,9 @@ in
     #   - tunneled hosts → home cluster ingress on 443
     streamConfig = ''
       map $ssl_preread_server_name $tunnel_upstream {
-        rss.rubenhensen.nl  ${homeIP}:443;
-        default             127.0.0.1:8443;
+        rss.rubenhensen.nl        ${homeIP}:443;
+        authentik.rubenhensen.nl  ${homeIP}:443;
+        default                   127.0.0.1:8443;
       }
 
       server {
@@ -78,6 +79,16 @@ in
       };
     };
 
+    virtualHosts."authentik.rubenhensen.nl" = {
+      listen = [
+        { addr = "0.0.0.0"; port = 80; }
+        { addr = "[::]"; port = 80; }
+      ];
+      locations."/" = {
+        proxyPass = "http://${homeIP}";
+      };
+    };
+
     virtualHosts."mail.rubenhensen.nl" = {
       listen = [
         { addr = "0.0.0.0"; port = 80; }