diff --git a/apps/base/grafana/grafana.yaml b/apps/base/grafana/grafana.yaml
index 82b6a1f..1665d71 100644
--- a/apps/base/grafana/grafana.yaml
+++ b/apps/base/grafana/grafana.yaml
@@ -26,13 +26,6 @@ spec:
                     secretKeyRef:
                       name: oauth-credentials
                       key: client_secret
-              # identity.unkin.net is served by the internal unkin.net CA, which
-              # the stock Grafana image doesn't trust. Mount the reflected
-              # vault-ca-cert and point generic_oauth's tls_client_ca at it.
-              volumeMounts:
-                - name: vault-ca-cert
-                  mountPath: /etc/grafana/vault-ca
-                  readOnly: true
               resources:
                 requests:
                   cpu: 100m
@@ -40,13 +33,6 @@ spec:
                 limits:
                   cpu: "1"
                   memory: 1Gi
-          volumes:
-            - name: vault-ca-cert
-              secret:
-                secretName: vault-ca-cert
-                items:
-                  - key: ca.crt
-                    path: ca.crt
   config:
     server:
       root_url: "https://grafana.k8s.syd1.au.unkin.net"
@@ -71,9 +57,6 @@ spec:
       auth_url: "https://identity.unkin.net/application/o/authorize/"
       token_url: "https://identity.unkin.net/application/o/token/"
       api_url: "https://identity.unkin.net/application/o/userinfo/"
-      # Trust the internal unkin.net CA that signs identity.unkin.net's cert
-      # (mounted from the reflected vault-ca-cert Secret).
-      tls_client_ca: "/etc/grafana/vault-ca/ca.crt"
       # Authentik permission groups -> Grafana roles. akP-grafana-admin is granted
       # to akR-global-admin members (and direct members) via terraform-authentik.
       role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'"