diff --git a/apps/base/grafana/grafana.yaml b/apps/base/grafana/grafana.yaml
index 88d363f..1665d71 100644
--- a/apps/base/grafana/grafana.yaml
+++ b/apps/base/grafana/grafana.yaml
@@ -51,10 +51,13 @@ spec:
       allow_sign_up: "true"
       use_pkce: "true"
       client_id: "grafana"
-      scopes: "openid email profile"
+      # ak_groups = hierarchical group claim from terraform-authentik (carries
+      # permission groups inherited via role groups).
+      scopes: "openid email profile ak_groups"
       auth_url: "https://identity.unkin.net/application/o/authorize/"
       token_url: "https://identity.unkin.net/application/o/token/"
       api_url: "https://identity.unkin.net/application/o/userinfo/"
-      # Authentik groups -> Grafana roles (adjust group name as needed).
-      role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'"
+      # Authentik permission groups -> Grafana roles. akP-grafana-admin is granted
+      # to akR-global-admin members (and direct members) via terraform-authentik.
+      role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'"
       role_attribute_strict: "false"