diff --git a/apps/overlays/au-syd1/gitea/values.yaml b/apps/overlays/au-syd1/gitea/values.yaml
index 0157d8a..c035b5c 100644
--- a/apps/overlays/au-syd1/gitea/values.yaml
+++ b/apps/overlays/au-syd1/gitea/values.yaml
@@ -71,6 +71,30 @@ resources:
     cpu: "2"
     memory: 2Gi
 
+# Trust the internal unkin.net CA that signs identity.unkin.net's cert. Gitea is
+# Go, so SSL_CERT_DIR adds the mounted vault-ca-cert to the system trust pool
+# (additive — public roots stay via the default bundle). Needed for the OIDC
+# discovery/JWKS fetch at login.
+deployment:
+  env:
+    - name: SSL_CERT_DIR
+      value: /etc/gitea/tls-ca
+extraVolumes:
+  - name: vault-ca-cert
+    secret:
+      secretName: vault-ca-cert
+      items:
+        - key: ca.crt
+          path: ca.crt
+extraContainerVolumeMounts:
+  - name: vault-ca-cert
+    mountPath: /etc/gitea/tls-ca
+    readOnly: true
+extraInitVolumeMounts:
+  - name: vault-ca-cert
+    mountPath: /etc/gitea/tls-ca
+    readOnly: true
+
 gitea:
   # Local admin fallback (survives the OIDC cutover). Secret keys: username,
   # password. Seeded in Vault -> synced to the gitea-admin Secret by VSO.
@@ -105,7 +129,7 @@ gitea:
     - name: "authentik"
       provider: "openidConnect"
       existingSecret: oauth-credentials
-      autoDiscoverUrl: "https://identity.k8s.syd1.au.unkin.net/application/o/gitea/.well-known/openid-configuration"
+      autoDiscoverUrl: "https://identity.unkin.net/application/o/gitea/.well-known/openid-configuration"
 
   config:
     server: