diff --git a/config/permissions/akP-mediamark-user.yaml b/config/permissions/akP-mediamark-user.yaml
new file mode 100644
index 0000000..a7f1e22
--- /dev/null
+++ b/config/permissions/akP-mediamark-user.yaml
@@ -0,0 +1,4 @@
+# Permission group akP-mediamark-user (name = filename). Grants user access to
+# mediamark: bound to the mediamark application, gating the kids-content
+# marking UI.
+application: mediamark
diff --git a/config/providers_oauth2/mediamark.yaml b/config/providers_oauth2/mediamark.yaml
new file mode 100644
index 0000000..5114ca8
--- /dev/null
+++ b/config/providers_oauth2/mediamark.yaml
@@ -0,0 +1,26 @@
+# OAuth2/OIDC provider + application for mediamark (the Go web UI for marking
+# media as kids content, served at https://mediamark.unkin.net (external
+# hostname) and https://mediamark.k8s.syd1.au.unkin.net (cluster hostname) in
+# its own mediamark namespace). An oauth2-proxy in front of the UI performs the
+# OIDC login with a relative redirect, so both hostnames must be registered;
+# access is gated on the user's hierarchical ak_groups claim
+# (akP-mediamark-user).
+# client_secret is read from Vault (seeded out of band), never committed.
+name: mediamark
+authorization_flow: default-provider-authorization-implicit-consent
+invalidation_flow: default-provider-invalidation-flow
+client_type: confidential
+client_id: mediamark
+launch_url: https://mediamark.unkin.net/
+client_secret_vault:
+  mount: kv
+  path: kubernetes/namespace/mediamark/default/oauth-credentials
+scope_mappings:
+  - goauthentik.io/providers/oauth2/scope-openid
+  - goauthentik.io/providers/oauth2/scope-email
+  - goauthentik.io/providers/oauth2/scope-profile
+redirect_uris:
+  - matching_mode: strict
+    url: https://mediamark.k8s.syd1.au.unkin.net/oauth2/callback
+  - matching_mode: strict
+    url: https://mediamark.unkin.net/oauth2/callback
diff --git a/config/roles/akR-media-adult.yaml b/config/roles/akR-media-adult.yaml
index 16f88e2..13620d1 100644
--- a/config/roles/akR-media-adult.yaml
+++ b/config/roles/akR-media-adult.yaml
@@ -2,7 +2,10 @@
 # adult ("fafflix") and kids ("cheeztv") services, so this role nests both
 # per-service entitlements. Membership propagates child -> parent, so a member
 # appears in both permission groups in the hierarchical `ak_groups` claim and the
-# media proxy routes/authorizes them for fafflix and cheeztv.
+# media proxy routes/authorizes them for fafflix and cheeztv. Adults also curate
+# which titles are kids content, so the role nests akP-mediamark-user for access
+# to the mediamark UI.
 permissions:
   - akP-media-fafflix
   - akP-media-cheeztv
+  - akP-mediamark-user