diff --git a/modules/authentik/main.tf b/modules/authentik/main.tf
index 33c6fe4..7d2687e 100644
--- a/modules/authentik/main.tf
+++ b/modules/authentik/main.tf
@@ -142,6 +142,13 @@ data "vault_kv_secret_v2" "oauth2" {
   name     = each.value.client_secret_vault.path
 }
 
+# Default JWT signing key for OAuth2 providers. Without a signing_key Authentik
+# signs ID tokens with HS256, which RS256-only RP clients (argocd, grafana, ...)
+# reject. Look up the estate's RSA keypair by name so providers default to RS256.
+data "authentik_certificate_key_pair" "signing" {
+  name = var.oauth2_signing_key_name
+}
+
 resource "authentik_provider_oauth2" "this" {
   for_each = var.providers_oauth2
 
@@ -156,7 +163,7 @@ resource "authentik_provider_oauth2" "this" {
     [authentik_property_mapping_provider_scope.groups_hierarchical.id],
     try([authentik_property_mapping_provider_scope.role[each.key].id], []),
   )
-  signing_key           = each.value.signing_key
+  signing_key           = coalesce(each.value.signing_key, data.authentik_certificate_key_pair.signing.id)
   access_token_validity = each.value.access_token_validity
   allowed_redirect_uris = each.value.redirect_uris
   grant_types           = each.value.grant_types
diff --git a/modules/authentik/variables.tf b/modules/authentik/variables.tf
index b96d052..ba09e75 100644
--- a/modules/authentik/variables.tf
+++ b/modules/authentik/variables.tf
@@ -98,6 +98,14 @@ variable "providers_oauth2" {
   default = {}
 }
 
+# Name of the RSA certificate keypair used to sign OAuth2 ID tokens (RS256) for
+# every provider that does not set its own signing_key. Defaults to Authentik's
+# built-in self-signed RSA keypair.
+variable "oauth2_signing_key_name" {
+  type    = string
+  default = "authentik Self-signed Certificate"
+}
+
 variable "providers_ldap" {
   type = map(object({
     name             = string