diff --git a/containers/authentik/default.nix b/containers/authentik/default.nix
index 8c34cb9..e1d2773 100644
--- a/containers/authentik/default.nix
+++ b/containers/authentik/default.nix
@@ -57,8 +57,8 @@ pkgs.dockerTools.buildLayeredImage {
   # authentik-django hardcodes blueprints_dir to $out/blueprints; the AUTHENTIK_BLUEPRINTS_DIR
   # env var overrides it to /blueprints, where custom blueprints are mounted by k8s ConfigMap.
   extraCommands = ''
-    mkdir -p blueprints
-    chmod 777 blueprints
+    mkdir -p blueprints tmp
+    chmod 777 blueprints tmp
   '';
 
   config = {