diff --git a/modules/authentik/main.tf b/modules/authentik/main.tf
index 7eee5cf..33c6fe4 100644
--- a/modules/authentik/main.tf
+++ b/modules/authentik/main.tf
@@ -159,6 +159,7 @@ resource "authentik_provider_oauth2" "this" {
   signing_key           = each.value.signing_key
   access_token_validity = each.value.access_token_validity
   allowed_redirect_uris = each.value.redirect_uris
+  grant_types           = each.value.grant_types
 }
 
 resource "authentik_provider_ldap" "this" {
diff --git a/modules/authentik/variables.tf b/modules/authentik/variables.tf
index 3395928..b96d052 100644
--- a/modules/authentik/variables.tf
+++ b/modules/authentik/variables.tf
@@ -67,6 +67,12 @@ variable "providers_oauth2" {
     # Managed identifiers of scope property mappings (e.g.
     # goauthentik.io/providers/oauth2/scope-openid). Resolved to ids.
     scope_mappings = optional(list(string), [])
+    # OAuth2 grant types the provider permits. Authentik 2026.5 added this as an
+    # explicit allow-list on the provider (models default = empty); an empty list
+    # rejects every authorize request with "invalid_request / The request is
+    # otherwise malformed". Default to the standard confidential web-app set so
+    # authorization_code (login) and refresh_token (offline access) work.
+    grant_types = optional(list(string), ["authorization_code", "refresh_token"])
     # allowed_redirect_uris is list(map(string)); the API always stores a
     # redirect_uri_type key, so it must be set here or every plan drifts.
     redirect_uris = optional(list(object({