diff --git a/.woodpecker/apply.yaml b/.woodpecker/apply.yaml
index 1af462c..6a3727f 100644
--- a/.woodpecker/apply.yaml
+++ b/.woodpecker/apply.yaml
@@ -8,6 +8,8 @@ steps:
     environment:
       VAULT_AUTH_METHOD: kubernetes
       VAULT_VERSION: "1.20.0"
+      # ClusterIP + sessionAffinity pins CI to one replica (goauthentik#954).
+      TF_VAR_authentik_url: http://authentik-server.authentik.svc.cluster.local
     commands:
       - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
       - make plan
diff --git a/.woodpecker/plan.yaml b/.woodpecker/plan.yaml
index 3f982dc..e7932b7 100644
--- a/.woodpecker/plan.yaml
+++ b/.woodpecker/plan.yaml
@@ -7,6 +7,8 @@ steps:
     environment:
       VAULT_AUTH_METHOD: kubernetes
       VAULT_VERSION: "1.20.0"
+      # ClusterIP + sessionAffinity pins CI to one replica (goauthentik#954).
+      TF_VAR_authentik_url: http://authentik-server.authentik.svc.cluster.local
     commands:
       - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
       - make plan
diff --git a/environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl b/environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl
index 3c6ba9b..c85bbe7 100644
--- a/environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl
+++ b/environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl
@@ -17,9 +17,6 @@ terraform {
 }
 
 inputs = {
-  # ClusterIP + sessionAffinity pins CI to one replica (goauthentik#954); local
-  # runs must export TF_VAR_authentik_url=https://identity.k8s.syd1.au.unkin.net
-  authentik_url     = "http://authentik-server.authentik.svc.cluster.local"
   groups            = local.config.groups
   permission_groups = local.config.permission_groups
   role_groups       = local.config.role_groups