diff --git a/argocd/apps/authentik.yaml b/argocd/apps/authentik.yaml
index 57c8109..1025dbe 100644
--- a/argocd/apps/authentik.yaml
+++ b/argocd/apps/authentik.yaml
@@ -1,11 +1,9 @@
-# NEEDS YOUR INPUT before first sync: targetRevision below is a placeholder.
-# Run `helm list -n authentik` on the live cluster and set this to the chart
-# version actually deployed (installed by hand per the header comment in
-# values/authentik.yaml) -- Authentik is the SSO IdP gating Argo CD/Grafana/
-# Gitea logins, so adopting it into GitOps with the wrong version could
-# trigger an unwanted live chart upgrade/downgrade on first sync. Sync is
-# left manual (no `automated:` block) until you've confirmed this and diffed
-# with `kubectl diff` / `argocd app diff`.
+# targetRevision below is confirmed against the live deployment's
+# helm.sh/chart=authentik-2026.2.1 label on the authentik-server pod (checked
+# 2026-07-23) -- not a guess. Sync is still left manual (no `automated:`
+# block): diff with `kubectl diff` / `argocd app diff` before enabling
+# automated sync, since Authentik is the SSO IdP gating Argo CD/Grafana/Gitea
+# logins.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -18,7 +16,7 @@ spec:
   sources:
     - repoURL: https://charts.goauthentik.io
       chart: authentik
-      targetRevision: "REPLACE_ME"
+      targetRevision: "2026.2.1"
       helm:
         valueFiles:
           - $values/values/authentik.yaml