diff --git a/containers/authentik/default.nix b/containers/authentik/default.nix
index 5b965bd..e65467a 100644
--- a/containers/authentik/default.nix
+++ b/containers/authentik/default.nix
@@ -12,7 +12,7 @@
 let
   sources = import ./sources.nix { inherit pkgs; };
   # Duplicated from sources.nix so build-container-nix.yaml can grep it
-  version = "2026.2.0";
+  version = "2026.2.2";
   webui = import ./webui.nix { inherit pkgs sources; };
   authentik-django = import ./authentik-django.nix { inherit pkgs sources webui; };
   authentik-server = import ./authentik-server.nix { inherit pkgs sources authentik-django webui; };
diff --git a/containers/authentik/python-deps.nix b/containers/authentik/python-deps.nix
index 17d557c..030bac4 100644
--- a/containers/authentik/python-deps.nix
+++ b/containers/authentik/python-deps.nix
@@ -119,7 +119,7 @@ pkgs.stdenv.mkDerivation {
 
   outputHashMode = "recursive";
   outputHashAlgo = "sha256";
-  outputHash = "sha256-DtpcYQyI07m7v84D/UC28Tj35R9wye6IX+1D0gMZPgY=";
+  outputHash = "sha256-PMNooWKoEWy/G0G3BLAWEJTqvj3FJi34ibougjwdE+c=";
 
   dontFixup = true;
 }
diff --git a/containers/authentik/sources.nix b/containers/authentik/sources.nix
index 9134fa8..96aed12 100644
--- a/containers/authentik/sources.nix
+++ b/containers/authentik/sources.nix
@@ -1,9 +1,9 @@
-# Centralized version and source pinning for authentik 2026.2.0
+# Centralized version and source pinning for authentik 2026.2.2
 # All sources fetched from forge mirrors for supply chain control
 { pkgs ? import <nixpkgs> { } }:
 
 let
-  version = "2026.2.0";
+  version = "2026.2.2";
 in
 {
   inherit version;
@@ -12,14 +12,14 @@ in
   src = pkgs.fetchgit {
     url = "https://forge.ops.eblu.me/mirrors/authentik.git";
     rev = "version/${version}";
-    hash = "sha256-pVQ34cZYX3hlk6hF1aZ/n32xMqTF4Jmp0G0VGDU7iXc=";
+    hash = "sha256-Xq7JGI/8ppIydIuWd9KRJKUrh7UpeniwvZ4NAtXbYJ4=";
   };
 
   # Go API client repo — provides config.yaml, go.mod, go.sum, templates
   client-go-src = pkgs.fetchgit {
     url = "https://forge.ops.eblu.me/mirrors/authentik-client-go.git";
-    rev = "v3.${version}";
-    hash = "sha256-DwXw/0QcSDYQKVhPA8tStrSoZooriQex/9FxSJtR/QY=";
+    rev = "v3.2026.2.1";
+    hash = "sha256-sFj+KAFHe3ajOFUtfBl9X3AVIvMCO8+Xba+/Jsy7Cgo=";
   };
 
   meta = with pkgs.lib; {
diff --git a/docs/changelog.d/+authentik-2026.2.2.infra.md b/docs/changelog.d/+authentik-2026.2.2.infra.md
new file mode 100644
index 0000000..7cb6e3f
--- /dev/null
+++ b/docs/changelog.d/+authentik-2026.2.2.infra.md
@@ -0,0 +1 @@
+Upgrade authentik 2026.2.0 → 2026.2.2 (bug-fix patch release)
diff --git a/service-versions.yaml b/service-versions.yaml
index c845629..64d043a 100644
--- a/service-versions.yaml
+++ b/service-versions.yaml
@@ -155,8 +155,8 @@ services:
 
   - name: authentik
     type: argocd
-    last-reviewed: "2026-03-01"
-    current-version: "2026.2.0"
+    last-reviewed: "2026-04-08"
+    current-version: "2026.2.2"
     upstream-source: https://github.com/goauthentik/authentik/releases
 
   - name: authentik-redis