diff --git a/bootstrap/argocd-cm-oidc-patch.yaml b/bootstrap/argocd-cm-oidc-patch.yaml
new file mode 100644
index 0000000..12fcca1
--- /dev/null
+++ b/bootstrap/argocd-cm-oidc-patch.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  oidc.config: |
+    name: Authentik
+    issuer: https://auth.whyredfire.dev/application/o/argocd/
+    clientID: argocd
+    clientSecret: $argocd-oidc:clientSecret
+    requestedScopes:
+      - openid
+      - profile
+      - email
diff --git a/bootstrap/argocd-rbac-cm-patch.yaml b/bootstrap/argocd-rbac-cm-patch.yaml
new file mode 100644
index 0000000..68c7f2c
--- /dev/null
+++ b/bootstrap/argocd-rbac-cm-patch.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+data:
+  policy.csv: |
+    g, admins, role:admin
+  policy.default: ""
+  scopes: "[groups]"
diff --git a/bootstrap/kustomization.yaml b/bootstrap/kustomization.yaml
index cc55174..22b6e1d 100644
--- a/bootstrap/kustomization.yaml
+++ b/bootstrap/kustomization.yaml
@@ -17,6 +17,14 @@ patches:
       kind: ConfigMap
       name: argocd-cm
     path: argocd-cm-url-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cm
+    path: argocd-cm-oidc-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-rbac-cm
+    path: argocd-rbac-cm-patch.yaml
   - target:
       kind: ConfigMap
       name: argocd-cmd-params-cm
diff --git a/infra/argocd-dashboard/kustomization.yaml b/infra/argocd-dashboard/kustomization.yaml
index 973b541..fc264a3 100644
--- a/infra/argocd-dashboard/kustomization.yaml
+++ b/infra/argocd-dashboard/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
   - anubis-key-sealedsecret.yaml
   - anubis-proxy.yaml
   - httproute.yaml
+  - oidc-sealedsecret.yaml
diff --git a/infra/argocd-dashboard/oidc-sealedsecret.yaml b/infra/argocd-dashboard/oidc-sealedsecret.yaml
new file mode 100644
index 0000000..d96d477
--- /dev/null
+++ b/infra/argocd-dashboard/oidc-sealedsecret.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-oidc
+  namespace: argocd
+spec:
+  encryptedData:
+    clientSecret: AgAuadGZNylY8/lomfIg8PybwBtfZ20BXDfNacgIMMdRanRgRnLhMghaZfcQbcGuKRaAIya/aIqbUKkQwat2elypOp374wvDHilnaQ0DQ4qCBGZlPLMSzyEoz+sSuB3c0YHLcj48DIF9b5b24jsysS9mllTQCeEBNsuXiEjEuSBUpu6EbR5ztRPnEi8OnuJYTMJtnMVX0iPEqEK4DsR/c7ActayVBG+sGDK/ZyACxyLg8cuhJ2p7SyxqCwqtaS4NaKC6d4WK+3LEQcAd65PWeSKbR7zv77EcUQ8yzaM3yDXIZMmgLMzynfPgyll9aLr31n2UOaNU2uZPT6JtlnPARU1WuzQHcRCdJBjuKneDahE2D3m7sClxUCNXTgXfZqsWl6/gSvZrREukQyJgIz6mmmN3rUjYRn0lG+0CU6o1uDFGHyn9GEmzTPT4zt/U0YD7LjwdR+tWHBUmzQCPbe2DcPQLb+OwyY0M9RC52btfJVyErjMXN7TP8ut1Gmf6p0phr9ebVH9hNAPWcfbWkNG4r8c4gzHDca9ULPrwjz1oJsNeHf6ZXu3Zu26xnFsLswSQqWSSpBrHA9F5bl3U3/ScNErD+wrP6lH6dqcGGJVpMMUhDDNBKkSsu8zL8M97x5MYZPwAI+EfNF5ijdzqZbgEU0iTjJv5fHX1i+rGhbzkfqvuI3ti/8CkcSB/dEAYQXwfmSrtPJISX1zEWhqzgIfIDuPk2BmD+rKmWL906+aff7M/Ns32wZlvN3eCPVjO9w80mkn6OJY11re0Si0eg4ksUZDH
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/part-of: argocd
+      name: argocd-oidc
+      namespace: argocd
diff --git a/infra/authentik/blueprints.yaml b/infra/authentik/blueprints.yaml
index 6922b48..47f19be 100644
--- a/infra/authentik/blueprints.yaml
+++ b/infra/authentik/blueprints.yaml
@@ -4,6 +4,65 @@ metadata:
   name: authentik-blueprints
   namespace: authentik
 data:
+  argocd.yaml: |
+    version: 1
+    metadata:
+      name: ArgoCD
+    entries:
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: mounted/cm-authentik-blueprints/google-login.yaml
+          required: true
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: default/flow-default-provider-authorization-implicit-consent.yaml
+          required: true
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: default/flow-default-provider-invalidation.yaml
+          required: true
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: system/providers-oauth2.yaml
+          required: true
+      - model: authentik_providers_oauth2.oauth2provider
+        id: provider
+        identifiers:
+          name: argocd
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          client_id: argocd
+          client_secret: !Env ARGOCD_OIDC_CLIENT_SECRET
+          client_type: confidential
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+          redirect_uris:
+            - matching_mode: strict
+              url: https://argo.whyredfire.dev/auth/callback
+            # argocd CLI (argocd login --sso)
+            - matching_mode: strict
+              url: http://localhost:8085/auth/callback
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+      - model: authentik_core.application
+        id: application
+        identifiers:
+          slug: argocd
+        attrs:
+          meta_launch_url: https://argo.whyredfire.dev
+          name: ArgoCD
+          provider: !KeyOf provider
+      - model: authentik_policies.policybinding
+        identifiers:
+          group: !Find [authentik_core.group, [name, admins]]
+          order: 0
+          target: !KeyOf application
   # Google is the only way in: its source has no enrollment flow, so a Google
   # account can only log in when a user with the same email already exists.
   google-login.yaml: |
diff --git a/infra/authentik/sealed-secret.yaml b/infra/authentik/sealed-secret.yaml
index fb66992..2b9261a 100644
--- a/infra/authentik/sealed-secret.yaml
+++ b/infra/authentik/sealed-secret.yaml
@@ -6,6 +6,7 @@ metadata:
   namespace: authentik
 spec:
   encryptedData:
+    ARGOCD_OIDC_CLIENT_SECRET: AgBHG4QvZ5SZuZQhFzQuIoEoKq2zeaArUvINUgNNqK8oDm5pTzRAC+gqhw9v3qCx3wpkW8/ayc9rVnHLL8ua81e3bXVywty+6fEMk0ryFzvOSNjXlOuTUAm2oOH8d0itWhNIWWiEIviL3ZB5w2uEZ9igV5wimyGJvAtptjkSRsfUlAmstoX5DMwB6NItq/7PkhrSqtZs9tsz9GqJ2szL3oC9WQSumF1BG17xySI7OeRBJ0K6A4FBorY8VZ/gCXjxvqZ6IJlkHq22SoX6Qt3ZJlRW3h8e5PtDqtCfKoWXgYIBjXaT7gW1mYxzpVGiaz0OIGoQkKckM0XZ6PBmU5tDbAhM7QwuG9haC/S2a6wVsAnjLM7BckMdaFirI6Pyg39gNJz9VUwKk3oWWUcFUJA+X2dvOoi0m4OBMXYfb1US5CDDJWDHliJYJy3hlnXtmLErL93D5DIF4ybR6JuZ54Nrv/cVaLd7u8+vSB1VX2qOMSuGgwZ//+pOgCzlRp8BW6l43uzWVx4oC4buFMl3yPNKcvCm2SJ9l84LhFdE+AbVptqAeXIe43x6cNE5wASb0nXnvQMv9zkypLng16HFWwx6nk8/ehgYyDTtQUewGhtpjJUCXUlIzZg91e4RGA0k47AxrAP58PjomBlOBCou6YoW6pRkcAF6izDLxhHQRBDiLnrXSXNMsqAkn9Xee3NICK0OGHyp+W2Uol0kU/tjy6aIJpblHx3vZbs7jyhtEB1gLbZQz8c5PcruuBaCMtwxDRBCP6cM/6DoiW5JsbL0maoBdU4/
     AUTHENTIK_BOOTSTRAP_PASSWORD: AgAPgYcs6IXUWk3VUgoPNQXwP43kEKP26OAJmu7dA4vTRhmWwmJXN8ybRhX7jS2YPwGWxAWflxiM3x7F3jUohOpqN37et4zFCoUq43mQ3blbTMV4zhsuyMx0JIqhsafzlVWiKqmqIykVq8yJQ6886FkIS0u14i//YTcs0QMS7gum6pDEhehAg+FhwiNgm92iVCyhoh+3rL549akXe53UJNKwVzuWavEHZFTKJNmFa2g9YzYcJgNf46f7maPbfSg09E27XC9L7KNxxiodU2h0D50La8LMEX+X0fAbLtrXPf9MsJjcfNvy0kXqy/AB+A5zL/Yh4uVztWikE27evDvfeoWc9svCTIbBzwx1EtR/nC71IvN61ADpFGbTXA44jSOtPg6nNtOAq8AEqIp0p3uNbQK17cEfbmDtq8husTYF1i6e+VFVGIltPiGdRSZb92xtLGkf63YfdYXSy+xaiIJ/8ki4vgw91KY0l5/9sS1BqWR312UUEAtOGt7M4cydVEWToc1AdYj3RDBgPjmqoddiR66EMzhCFz5sxlU/rji7j4DAOFA4gqAV5JAZO1HehNFp2GajTi36d0XLe06/Z+IbEmSeTlPTGZOvxTweYcWexplzp/ob/MwAaMouPRcmae4/VTlu9Lex1bMYugc6bD8B7V+gmM/MhY7heQl+mSyBV0CO6JsZwC1tipzcJfaiBzUF8sZ7Ast3v+7omsjFo/CXqxbPNZrolipiEjE9IT3n3r2m7gpIkv+A/ie77iJF8k6zFRM=
     AUTHENTIK_POSTGRESQL__PASSWORD: AgAoQ04gX1QOUI5kfNMNy07pnaqDTp4X6LDlQBBwSs13SVGZCJAL61hQymOaL/U2cCyc0N5nr7FCswHcqBE8t1esKlK/NB+BL9aWfO7uPonhdzsc2iKBONZYickCyyD+8Hgu/McQDPVo6vMQ51/82WL2ZKfwJEfTKmo1OfJ/I2Tls2KmczzlkNrCC9M5moObXl+PJlKJuxAkeXJc61MSn/vvsvksG5O0AKtXHmTk8E1t7krAbOqKy9CbVwHJAwH/NIhiOgJr/KziceWhHHQiEwC631ZpM+fZWiUSKETwpnLWSl7s8SvsEUNA9s/W2w24tpqSKrHOZtS6J0sT84FsV9U9T5MaZtZT9NG3FmNehxQpIlet6BSyJh+JMq5LjzA8ANvVvlXs4jhJyTcotLf/m1ZJbetVjFGJjvxUbVuxObpMentVrAeLO8cZqk1iTzqPdkrEeV38DN2E9oJSyQeRP6sZTnDd9xweou8nwMZWidyIDorTKSwvggje2YDXefc8+aOVVCN7pBOwKisEuPH35Ov/A2RDzmE3mQRC3EDuHJ+3dZbVawIawV0ZUIL52X+ongbllOtHABUfODY7tTC/VQMk07d3/zG5q7bCE2D+R0XE4oQJy2h2wYHiYUoGYM5JKC2me4TIx6Y+haksl2mqfC/yal3FLWMBdK4eC9VyXugO25l4yLVOcKa/QMhImHB6lbyNLGDuafnIanMkraWo73EqqXpF3IIqfzfgkj4aOO3Cbuu6BeQ4bNmmam+cWLqq1QQ=
     AUTHENTIK_SECRET_KEY: AgAHHDs8mbJRc45DFgap2VUZn/F+m59hm9u2lebuJv70HSBxLLsHEn8nXLGUO3b2ScyPt1Qi2wbmRDENTjOHOYHtAQAjwV25r6RUiZ5TosRH2KhGx5N6gceorYQyk18l2CkKv4ObXjeGLJA0EqMarmFWiT24SFZdtIrOvWygLxg4XGful2h1Fw5uXK9PiUHgptrp/G5M5Htv0bvtD6m/FrgOlK6C6tK1D4vLL3VLX3/SceqNWVDIJmJao5JKO4IZTQxN8TN5k9K2CGrtOUhjCn4vLbYQKTPhiiidoQaipQ9FR+4KJMO0y8FbIy+3q7C/UZPyOTOu/2zI4t5h4TJY1+477A80GTLpE0aCBDpmFwgZY728wbTW4NyfIm15u0Um7OXhnJkXC1EqDbvlK4HYHiSDUjGChvlfMEY+D1datDlF1fEuIaeXtTqowpz3uy9qIEa0f1emS2J8TjIrKH3oW3mfmrJKSiySnCX1704ZPlwOJfnF5Z2vM6Oqo/mWHa6PSwPPRxSxEKVtSqD4KynzrUmx3GkrUs+7tntepA3yQoiDjyUyE71FwhJXO4sE3XcRGDUf4rB8CFO4+NgTbBAqFzNKYG32GIDhGjbMxBAJQMNXZhVcKceiaXf7G8LuaOEw39BkdtiFCdK3uXl9xaQPuStRsOYYQR2Dt0vt3AvDGjAW+McauCbYUD3rcAtVMo+rxEbejrotojWnb1OpGX0JqD5gHC68qlqY6BYkDbWpYojoKWJHuHlYxHIm8k7ghSq6npw94R526bxripNtcNq4Lh1NeM55LKruOEGr7n0dFcyAmQ==