diff --git a/kube/deploy/apps/authentik/app/hr.yaml b/kube/deploy/apps/authentik/app/hr.yaml
index 5787cda0..50d94e60 100644
--- a/kube/deploy/apps/authentik/app/hr.yaml
+++ b/kube/deploy/apps/authentik/app/hr.yaml
@@ -18,7 +18,7 @@ spec:
       repository: "ghcr.io/goauthentik/server"
       tag: "2023.10.7" # specify image tag for Renovate to pull changelogs & security info, and for security releases without a chart release
       #digest: "sha256:8ebdd51a95d3efdcb0cf3b26ed849cc0f9a8c032adb8cd595cabb59a1f321161" # TODO: apparently Renovate doesn't see this as a digest?
-      pullPolicy: IfNotPresent 
+      pullPolicy: IfNotPresent
     # server is in active-active, 3 replicas seems to confuse authentik
     replicas: 2
     worker:
@@ -48,6 +48,7 @@ spec:
       tls:
         - hosts:
             - *host
+          secretName: authentik-tls
     volumes:
     - name: authentik-tls
       secret: