diff --git a/apps/base/litellm/kustomization.yaml b/apps/base/litellm/kustomization.yaml
index b4780fe..61754ea 100644
--- a/apps/base/litellm/kustomization.yaml
+++ b/apps/base/litellm/kustomization.yaml
@@ -32,7 +32,10 @@ configMapGenerator:
       - GENERIC_AUTHORIZATION_ENDPOINT=https://identity.unkin.net/application/o/authorize/
       - GENERIC_TOKEN_ENDPOINT=https://identity.unkin.net/application/o/token/
       - GENERIC_USERINFO_ENDPOINT=https://identity.unkin.net/application/o/userinfo/
-      - GENERIC_SCOPE=openid email profile
+      # litellm_role scope carries the Authentik-computed role claim; LiteLLM
+      # reads it via GENERIC_USER_ROLE_ATTRIBUTE and maps to proxy_admin/etc.
+      - GENERIC_SCOPE=openid email profile litellm_role
+      - GENERIC_USER_ROLE_ATTRIBUTE=litellm_role
       - PROXY_BASE_URL=https://litellm.k8s.syd1.au.unkin.net
     options:
       disableNameSuffixHash: true