diff --git a/Caddyfile b/Caddyfile
index 0b1d1d9..8a18120 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -223,3 +223,11 @@ secrets.hubris.network {
 	}
 	reverse_proxy 192.168.8.205:9820
 }
+
+# Authentik LAN forward-auth outpost (external_host for domain-level providers)
+sso.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.6:9000
+}