diff --git a/modules/authentik/variables.tf b/modules/authentik/variables.tf
index f08c87d..d2f5d0c 100644
--- a/modules/authentik/variables.tf
+++ b/modules/authentik/variables.tf
@@ -40,9 +40,12 @@ variable "providers_oauth2" {
     # Managed identifiers of scope property mappings (e.g.
     # goauthentik.io/providers/oauth2/scope-openid). Resolved to ids.
     scope_mappings = optional(list(string), [])
+    # allowed_redirect_uris is list(map(string)); the API always stores a
+    # redirect_uri_type key, so it must be set here or every plan drifts.
     redirect_uris = optional(list(object({
-      matching_mode = optional(string, "strict")
-      url           = string
+      matching_mode     = optional(string, "strict")
+      url               = string
+      redirect_uri_type = optional(string, "authorization")
     })), [])
     signing_key           = optional(string, null)
     access_token_validity = optional(string, "minutes=10")