diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml
index 5ed558dc..a5c8f713 100644
--- a/kubernetes/apps/authentik/blueprints-configmap.yaml
+++ b/kubernetes/apps/authentik/blueprints-configmap.yaml
@@ -555,7 +555,7 @@ data:
             # return entries instead of short-circuiting. Built from
             # the samba-bridge repo at
             # gitea.renner.uno/k.renner/authentik-samba-bridge .
-            container_image: gitea.renner.uno/k.renner/authentik-samba-bridge-ldap-outpost:2026.2.3-0140972
+            container_image: gitea.renner.uno/k.renner/authentik-samba-bridge-ldap-outpost:2026.5.3-f02b945
             object_naming_template: "ak-outpost-%(name)s"
             kubernetes_namespace: authentik
             kubernetes_replicas: 1
diff --git a/kubernetes/apps/authentik/helmrelease.yaml b/kubernetes/apps/authentik/helmrelease.yaml
index 439dc815..8069a3a3 100644
--- a/kubernetes/apps/authentik/helmrelease.yaml
+++ b/kubernetes/apps/authentik/helmrelease.yaml
@@ -17,7 +17,10 @@ spec:
   chart:
     spec:
       chart: authentik
-      version: ">=2025.12.0"
+      # Pinned to match the samba-bridge fork's app image (server.Dockerfile
+      # AUTHENTIK_VERSION). Bump in lockstep with the bridge rebuild — a
+      # floating range drifts the chart ahead of the pinned app image.
+      version: "2026.5.3"
       sourceRef:
         kind: HelmRepository
         name: authentik
@@ -49,7 +52,7 @@ spec:
         # 2. Pinning means the deployed binary is traceable to a
         #    specific repo commit. Bump the tag whenever a new build
         #    is published from gitea.renner.uno/k.renner/authentik-samba-bridge .
-        tag: "2026.2.3-b06668e"
+        tag: "2026.5.3-f02b945"
       envFrom:
         # SAMBA_BRIDGE_DOMAIN_SID / _ENABLED_GROUP / _UID_OFFSET
         # consumed by the bridge module at Django app startup. Missing