diff --git a/authentik/compose.yml b/authentik/compose.yml
new file mode 100644
index 0000000..6fd3795
--- /dev/null
+++ b/authentik/compose.yml
@@ -0,0 +1,70 @@
+services:
+  authentik:
+    image: ghcr.io/goauthentik/server:latest
+    container_name: authentik
+    restart: unless-stopped
+    command: server
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_POSTGRESQL__HOST: postgres
+      AUTHENTIK_POSTGRESQL__NAME: authentik
+      AUTHENTIK_POSTGRESQL__USER: authentik
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
+      AUTHENTIK_AVATARS: none
+      AUTHENTIK_LOG_LEVEL: info
+    volumes:
+      - ./media:/media
+      - ./custom-templates:/templates
+    labels:
+      # --- Traefik 路由 ---
+      - "traefik.enable=true"
+      - "traefik.http.routers.authentik.rule=Host(`auth.xiteng.site`)"
+      - "traefik.http.services.authentik.loadbalancer.server.port=9000"
+      - "traefik.http.routers.authentik.entrypoints=websecure"
+      - "traefik.http.routers.authentik.tls=true"
+      - "traefik.http.routers.authentik.tls.certresolver=cfresolver"
+      # --- HTTP 入口 ---
+      - "traefik.http.routers.authentik-http.rule=Host(`auth.xiteng.site`)"
+      - "traefik.http.routers.authentik-http.service=authentik"
+      - "traefik.http.routers.authentik-http.entrypoints=web"
+      # --- Homepage ---
+      - "homepage.group=我的服务"
+      - "homepage.name=Authentik"
+      - "homepage.icon=authentik"
+      - "homepage.href=https://auth.xiteng.site"
+      - "homepage.description=统一认证"
+      # --- AutoKuma ---
+      - "kuma.authentik.http.name=Authentik"
+      - "kuma.authentik.http.url=http://authentik:9000/-/health/ready/"
+      - "kuma.authentik.http.interval=60"
+      - "kuma.authentik.http.max_retries=3"
+    networks:
+      - homelab_net
+
+  postgres:
+    image: postgres:16-alpine
+    container_name: authentik-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: authentik
+      POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD}
+      POSTGRES_DB: authentik
+    volumes:
+      - ./pgdata:/var/lib/postgresql/data
+    networks:
+      - homelab_net
+
+  redis:
+    image: redis:alpine
+    container_name: authentik-redis
+    restart: unless-stopped
+    volumes:
+      - ./redis:/data
+    networks:
+      - homelab_net
+
+networks:
+  homelab_net:
+    external: true
diff --git a/cloudflared/compose.yml b/cloudflared/compose.yml
index c1dc835..503d194 100644
--- a/cloudflared/compose.yml
+++ b/cloudflared/compose.yml
@@ -1,6 +1,6 @@
 services:
   cloudflared:
-    image: cloudflare/cloudflared:latest
+    image: cloudflare/cloudflared:2025.5.0
     container_name: cloudflared
     restart: unless-stopped
     command: tunnel --protocol http2 run