diff --git a/traefik/dynamic/middlewares.yml b/traefik/dynamic/middlewares.yml
index aae708c..0bd02ec 100644
--- a/traefik/dynamic/middlewares.yml
+++ b/traefik/dynamic/middlewares.yml
@@ -48,6 +48,29 @@ http:
           - "172.64.0.0/13"
           - "131.0.72.0/22"
 
+    # Authentik + secure headers
+    security-chain:
+      chain:
+        middlewares:
+          - authentik@file
+          - security-headers@file
+    authentik:
+      forwardAuth:
+        address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-authentik-username
+          - X-authentik-groups
+          - X-authentik-email
+          - X-authentik-name
+          - X-authentik-uid
+          - X-authentik-jwt
+          - X-authentik-meta-jwks
+          - X-authentik-meta-outpost
+          - X-authentik-meta-provider
+          - X-authentik-meta-app
+          - X-authentik-meta-version
+
     # Security Headers
     security-headers:
       headers:
@@ -82,5 +105,5 @@ http:
     nextcloud-chain:
       chain:
         middlewares:
-          - nextcloud-secure-headers
-          - security-headers
\ No newline at end of file
+          - nextcloud-secure-headers@file
+          - security-headers@file