diff --git a/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml b/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
index 1c587f2..57247fc 100644
--- a/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
+++ b/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
@@ -20,6 +20,9 @@ data:
       - openid
       - profile
       - email
+      # Hierarchical group claim from terraform-authentik (includes permission
+      # groups inherited via role groups). Read for RBAC below.
+      - ak_groups
     requestedIDTokenClaims:
-      groups:
+      ak_groups:
         essential: true
diff --git a/clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml b/clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml
index 4bb25ff..a27a8b0 100644
--- a/clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml
+++ b/clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml
@@ -5,10 +5,12 @@ metadata:
   name: argocd-rbac-cm
   namespace: argocd
 data:
-  # Match RBAC subjects against the `groups` claim from Authentik.
-  scopes: "[groups]"
+  # Match RBAC subjects against the hierarchical `ak_groups` claim from Authentik
+  # (carries permission groups inherited via role groups).
+  scopes: "[ak_groups]"
   # Authenticated users with no matching group get read-only access.
   policy.default: role:readonly
-  # Authentik group -> ArgoCD role.
+  # Authentik permission group -> ArgoCD role. akP-argocd-admin is granted to
+  # akR-global-admin members (and direct members) via terraform-authentik.
   policy.csv: |
-    g, argocd-admins, role:admin
+    g, akP-argocd-admin, role:admin