diff --git a/config/groups/argocd-admins.yaml b/config/groups/argocd-admins.yaml
new file mode 100644
index 0000000..0b49b57
--- /dev/null
+++ b/config/groups/argocd-admins.yaml
@@ -0,0 +1,3 @@
+# Members of this group get ArgoCD role:admin (mapped in argocd-rbac-cm).
+# Everyone else who logs in via Authentik gets role:readonly.
+name: argocd-admins