diff --git a/docs/reference/services/navidrome.md b/docs/reference/services/navidrome.md
index 08a7649..5f93331 100644
--- a/docs/reference/services/navidrome.md
+++ b/docs/reference/services/navidrome.md
@@ -1,6 +1,6 @@
 ---
 title: Navidrome
-modified: 2026-02-07
+modified: 2026-02-21
 tags:
   - service
   - media
@@ -37,6 +37,10 @@ The `/data` directory contains SQLite database, configuration, and cache.
 | `ND_MUSICFOLDER` | /music |
 | `ND_DATAFOLDER` | /data |
 
+## Authentication
+
+Local accounts only. Authentik SSO integration was evaluated (Feb 2026) but not pursued — Navidrome lacks native OIDC support. The reverse proxy auth approach (`ND_EXTAUTH_*`) can pass a username header from Authentik, but cannot map Authentik groups to Navidrome admin status, making group-based admin delegation impossible.
+
 ## Related
 
 - [[jellyfin]] - Video streaming