diff --git a/kube/deploy/apps/authentik/app/hr.yaml b/kube/deploy/apps/authentik/app/hr.yaml
index af18ca6e..5ea53af8 100644
--- a/kube/deploy/apps/authentik/app/hr.yaml
+++ b/kube/deploy/apps/authentik/app/hr.yaml
@@ -337,6 +337,11 @@ spec:
         defaultMode: 0400
         globalMounts:
           - path: "/certs/${APP_DNS_AUTHENTIK}-k8s"
+      tmp:
+        type: emptyDir
+        medium: Memory
+        globalMounts:
+          - path: "/media/public"
     defaultPodOptions:
       automountServiceAccountToken: false
       enableServiceLinks: false