diff --git a/apps/base/litellm/deployment.yaml b/apps/base/litellm/deployment.yaml
index 6039b10..68230d6 100644
--- a/apps/base/litellm/deployment.yaml
+++ b/apps/base/litellm/deployment.yaml
@@ -30,6 +30,14 @@ spec:
             - containerPort: 4000
               name: http
               protocol: TCP
+          env:
+            # Authentik OIDC client secret (SSO); non-secret SSO config is in the
+            # litellm-env ConfigMap.
+            - name: GENERIC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
           envFrom:
             - secretRef:
                 name: litellm-credentials
diff --git a/apps/base/litellm/kustomization.yaml b/apps/base/litellm/kustomization.yaml
index 3b22566..b4780fe 100644
--- a/apps/base/litellm/kustomization.yaml
+++ b/apps/base/litellm/kustomization.yaml
@@ -25,5 +25,14 @@ configMapGenerator:
   - name: litellm-env
     literals:
       - STORE_MODEL_IN_DB=True
+      # Authentik OIDC SSO (generic). Client secret is injected from the
+      # oauth-credentials Secret in the Deployment; endpoints match the other
+      # apps (identity.unkin.net). PROXY_BASE_URL is required for SSO.
+      - GENERIC_CLIENT_ID=litellm
+      - GENERIC_AUTHORIZATION_ENDPOINT=https://identity.unkin.net/application/o/authorize/
+      - GENERIC_TOKEN_ENDPOINT=https://identity.unkin.net/application/o/token/
+      - GENERIC_USERINFO_ENDPOINT=https://identity.unkin.net/application/o/userinfo/
+      - GENERIC_SCOPE=openid email profile
+      - PROXY_BASE_URL=https://litellm.k8s.syd1.au.unkin.net
     options:
       disableNameSuffixHash: true
diff --git a/apps/base/litellm/vaultstaticsecret.yaml b/apps/base/litellm/vaultstaticsecret.yaml
index be33d93..148a1ec 100644
--- a/apps/base/litellm/vaultstaticsecret.yaml
+++ b/apps/base/litellm/vaultstaticsecret.yaml
@@ -18,6 +18,24 @@ spec:
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: litellm
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  # Same secret Authentik sets on the litellm OAuth2 provider (key: client_secret).
+  path: kubernetes/namespace/litellm/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
 metadata:
   name: litellm-credentials
   namespace: litellm