diff --git a/apps/uptime-kuma/ingress.yaml b/apps/uptime-kuma/ingress.yaml
index 8561b00..3160755 100644
--- a/apps/uptime-kuma/ingress.yaml
+++ b/apps/uptime-kuma/ingress.yaml
@@ -6,6 +6,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-cloudflare
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: uptime-kuma-authentik@kubernetescrd
 spec:
   tls:
   - hosts:
diff --git a/apps/uptime-kuma/middleware.yaml b/apps/uptime-kuma/middleware.yaml
new file mode 100644
index 0000000..7b7af7c
--- /dev/null
+++ b/apps/uptime-kuma/middleware.yaml
@@ -0,0 +1,13 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authentik
+  namespace: uptime-kuma
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local:80/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email