diff --git a/modules/authentik/main.tf b/modules/authentik/main.tf
index f6fc278..2ab3da6 100644
--- a/modules/authentik/main.tf
+++ b/modules/authentik/main.tf
@@ -3,7 +3,7 @@ resource "authentik_group" "this" {
 
   name         = each.value.name
   is_superuser = each.value.is_superuser
-  parents      = each.value.parents != null ? [for p in each.value.parents : authentik_group.this[p].id] : []
+  parents      = each.value.parents
   attributes   = jsonencode(each.value.attributes)
 }
 
diff --git a/modules/authentik/variables.tf b/modules/authentik/variables.tf
index 6b497a0..f08c87d 100644
--- a/modules/authentik/variables.tf
+++ b/modules/authentik/variables.tf
@@ -2,8 +2,10 @@ variable "groups" {
   type = map(object({
     name         = string
     is_superuser = optional(bool, false)
-    parents      = optional(list(string), null)
-    attributes   = optional(map(string), {})
+    # PKs of existing parent groups. These must be literal group PKs, not keys
+    # into this map: authentik_group cannot reference itself.
+    parents    = optional(list(string), null)
+    attributes = optional(map(string), {})
   }))
   default = {}
 }