diff --git a/CONTAINERS.md b/CONTAINERS.md
index f22d262..f941bf1 100644
--- a/CONTAINERS.md
+++ b/CONTAINERS.md
@@ -1,6 +1,6 @@
 # Container Reference - tower-of-joy Infrastructure
 
-> **Last Updated:** 2026-01-03
+> **Last Updated:** 2026-01-04
 > **Total Services:** 26 containers across 20 stacks  
 > **System:** Intel i7-6700, RTX 2080 Ti (11GB VRAM), 64GB RAM, Zorin OS 16.3
 
@@ -12,7 +12,7 @@
 |---------|---------|-----|-----------------|-----|----------|--------|
 | **Portainer** | 8080, 8443 | http://192.168.86.149:8080 | LAN | No | - | ✅ Running |
 | **Nginx Proxy Manager** | 81 (admin), 80, 443 | http://192.168.86.149:81 | Internet | No | - | ✅ Running |
-| **Authentik** | 9000, 9445 (outpost) | https://auth.schweitz.net | Internet (SSO) | No | 0 | ⚠️ Partial |
+| **Authentik** | 9000, 9444 (outpost) | https://auth.schweitz.net | Internet (SSO) | No | - | ✅ Running |
 | **PostgreSQL Shared** | 5432 | N/A (internal) | No | No | - | ✅ Running |
 | **Redis Shared** | 6379 | N/A (internal) | No | No | - | ✅ Running |
 | **Ollama** | 11434 | http://192.168.86.149:11434 | LAN | Yes (RTX 2080 Ti) | - | ✅ Running |
@@ -163,7 +163,7 @@ PostgreSQL Shared is a centralized PostgreSQL 17 database server providing isola
 
 ### Redis Shared
 
-Redis Shared is a centralized Redis 7 key-value store providing cache, session storage, and message queue capabilities for multiple applications, with logical database isolation (DB 0-15) allowing each service to maintain separate keyspaces within the same Redis instance. It implements a shared infrastructure pattern where applications like Authentik use DB 0 for sessions/cache while future services can use DB 1-15, eliminating the need for separate Redis containers per application. The service stores data on the HDD for persistence across restarts, with AOF (Append-Only File) enabled for durability and optional RDB snapshots for backup points.
+Redis Shared is a centralized Redis 7 key-value store providing cache, session storage, and message queue capabilities for multiple applications, with logical database isolation (DB 0-15) allowing each service to maintain separate keyspaces within the same Redis instance. It implements a shared infrastructure pattern where applications use dedicated database numbers, eliminating the need for separate Redis containers per application. The service stores data on the HDD for persistence across restarts, with AOF (Append-Only File) enabled for durability and optional RDB snapshots for backup points.
 
 | Property | Value |
 |----------|-------|
@@ -179,7 +179,7 @@ Redis Shared is a centralized Redis 7 key-value store providing cache, session s
 | **Resource Limits** | None |
 | **GPU Required** | No |
 | **Dependencies** | docker-dataplane network |
-| **Database Allocation** | DB 0: Authentik, DB 1: Tatlock (memory), DB 2: Wiki.js, DB 3: Scheduler, DB 4: Library Desk, DB 5: SearXNG, DB 6: Tatlock (benchmarks), DB 7: Nextcloud, DB 8: Paperless, DB 9-15: Available |
+| **Database Allocation** | DB 0: Available, DB 1: Tatlock (memory), DB 2: Wiki.js, DB 3: Scheduler, DB 4: Library Desk, DB 5: SearXNG, DB 6: Tatlock (benchmarks), DB 7: Nextcloud, DB 8: Paperless, DB 9-15: Available |
 | **Persistence** | AOF (Append-Only File) enabled for durability |
 | **Health Check** | `redis-cli ping` returns PONG (30s interval) |
 | **Connection String** | `redis://redis-shared:6379/0` (DB 0), `redis://redis-shared:6379/1` (DB 1), etc. |
@@ -696,4 +696,4 @@ redis-cli -h redis-shared          # Redis connection
 
 ---
 
-*Last Updated: 2025-12-30*
+*Last Updated: 2026-01-04*
diff --git a/stacks/authentik.yml b/stacks/authentik.yml
index eee18df..e39d929 100644
--- a/stacks/authentik.yml
+++ b/stacks/authentik.yml
@@ -9,7 +9,7 @@ version: '3.8'
 
 services:
   authentik-server:
-    image: ghcr.io/goauthentik/server:2024.8.4  # Pinned version (2024.10 has redirect loop issues)
+    image: ghcr.io/goauthentik/server:2025.10.3  # Pinned version (2024.10 has redirect loop issues)
     container_name: authentik-server
     restart: unless-stopped
     command: server
@@ -33,11 +33,6 @@ services:
       AUTHENTIK_POSTGRESQL__PASSWORD: F//j0ktck7cX06Vfgh0YXceONOtlSsHvadqROICeDx8=
       AUTHENTIK_POSTGRESQL__USE_PGBOUNCER: false
 
-      # Redis (shared)
-      AUTHENTIK_REDIS__HOST: redis-shared
-      AUTHENTIK_REDIS__PORT: 6379
-      AUTHENTIK_REDIS__DB: 0
-
       # Secret key (generated: openssl rand -base64 32)
       AUTHENTIK_SECRET_KEY: TnFaTZ//RDcO2hxVR4QGOBORd5tfXe4Vok+lcAz/AdE=
 
@@ -79,7 +74,7 @@ services:
           memory: 256M
 
   authentik-worker:
-    image: ghcr.io/goauthentik/server:2024.8.4  # Same version as server
+    image: ghcr.io/goauthentik/server:2025.10.3  # Same version as server
     container_name: authentik-worker
     restart: unless-stopped
     command: worker
@@ -106,7 +101,7 @@ services:
 
       # Worker-specific configuration
       AUTHENTIK_BOOTSTRAP_WORKERS: 1   # Single worker (homelab scale)
-      AUTHENTIK_WORKER__CONCURRENCY: 2  # 2 threads per worker
+      AUTHENTIK_WORKER__THREADS: 2  # 2 threads per worker
 
     volumes:
       - /home/jpmschweitzer/docker-data/authentik/media:/media
@@ -136,7 +131,7 @@ services:
           memory: 128M
 
   authentik-proxy:
-    image: ghcr.io/goauthentik/proxy:2024.8.4  # Standalone outpost (embedded outpost not working in 2024.8.4)
+    image: ghcr.io/goauthentik/proxy:2025.10.3  # Standalone outpost (embedded outpost not working in 2024.8.4)
     container_name: authentik-proxy
     restart: unless-stopped
     environment: