diff --git a/kube/deploy/apps/authentik/app/hr.yaml b/kube/deploy/apps/authentik/app/hr.yaml
index 5c5970be..df8676c0 100644
--- a/kube/deploy/apps/authentik/app/hr.yaml
+++ b/kube/deploy/apps/authentik/app/hr.yaml
@@ -57,7 +57,7 @@ spec:
           app:
             image: &img
               repository: ghcr.io/goauthentik/server
-              tag: 2025.8.4@sha256:a10398480e7f8292dbcc27b64fe572f6abed6220bd40f4b6d28e9c12d4b78dca
+              tag: 2025.10.1@sha256:8f70895ad48bb7de656a2aac7c78c2bec6a4e820e009a570b0c285fe406eadac
             args: [server]
             env: &env
               TZ: "${CONFIG_TZ}"
@@ -226,7 +226,7 @@ spec:
             image:
               <<: *img
               repository: ghcr.io/goauthentik/ldap
-              tag: 2025.8.4@sha256:5948a57d5c9af9134eb22550cbc4084c8d441fd00c2cab250f4a1445727d3262
+              tag: 2025.10.1@sha256:feefd8648fd43f11a091ef351122778735b51d43b275aa4293554b23daa9aa52
             env:
               AUTHENTIK_HOST: "https://${APP_DNS_AUTHENTIK}"
               AUTHENTIK_TOKEN:
@@ -274,7 +274,7 @@ spec:
             image:
               <<: *img
               repository: ghcr.io/goauthentik/radius
-              tag: 2025.8.4@sha256:4a329cbcccd3c2491497f40858b005a66cd695f7966090cce6a2552622922909
+              tag: 2025.10.1@sha256:80b7f3dbb518437de6f16173cfc63929c3cbf3c2b41b74bda67096570f5e44a8
             env:
               AUTHENTIK_HOST: "https://${APP_DNS_AUTHENTIK}"
               AUTHENTIK_TOKEN:
diff --git a/kube/deploy/apps/authentik/ks.yaml b/kube/deploy/apps/authentik/ks.yaml
index 012a9790..d2c1c1fc 100644
--- a/kube/deploy/apps/authentik/ks.yaml
+++ b/kube/deploy/apps/authentik/ks.yaml
@@ -35,4 +35,4 @@ spec:
       PG_SC: "local"
       PG_CONFIG_VERSION: "15.2-11"
       PG_CONFIG_SIZE: "20Gi"
-      PG_APP_CURRENT_VERSION: ghcr.io/goauthentik/server:2025.8.4@sha256:acde6a1fc963301fe27f7e86facb9aefbc68eb523210bcab5679a899e6bf72d5
+      PG_APP_CURRENT_VERSION: ghcr.io/goauthentik/server:2025.10.1@sha256:acde6a1fc963301fe27f7e86facb9aefbc68eb523210bcab5679a899e6bf72d5