diff --git a/inventories/demo-gymburgdorf/host_vars/application/authentik_outpost_ldap.yml b/inventories/demo-gymburgdorf/host_vars/application/authentik_outpost_ldap.yml
index fa81a01..b280ce4 100644
--- a/inventories/demo-gymburgdorf/host_vars/application/authentik_outpost_ldap.yml
+++ b/inventories/demo-gymburgdorf/host_vars/application/authentik_outpost_ldap.yml
@@ -8,3 +8,6 @@ _authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data
 # the LAN with a valid cert and matches the iss claim authentik emits.
 authentik_outpost_ldap_host: "https://auth.gymb.souveredu.ch"
 authentik_outpost_ldap_token: "{{ _authentik.ldap_outpost_token }}"
+# auth.gymb.* presents a valid Let's Encrypt cert via the reverseproxy, so
+# verify the chain instead of relying on the role's insecure default.
+authentik_outpost_ldap_insecure: "false"
diff --git a/inventories/demo-gymburgdorf/host_vars/storage/authentik_outpost_proxy.yml b/inventories/demo-gymburgdorf/host_vars/storage/authentik_outpost_proxy.yml
index 74a3209..df7b628 100644
--- a/inventories/demo-gymburgdorf/host_vars/storage/authentik_outpost_proxy.yml
+++ b/inventories/demo-gymburgdorf/host_vars/storage/authentik_outpost_proxy.yml
@@ -10,7 +10,10 @@ _authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data
 # via the internal DNS view to the DMZ reverseproxy the storage subnet can
 # reach). Token must match the storage-proxy-outpost registered in
 # authentik (see application/authentik.yml authentik_proxy_outposts).
+# Verify the authentik TLS chain: auth.gymb.* presents a valid Let's
+# Encrypt cert via the reverseproxy and the storage subnet reaches it, so
+# there's no reason to disable verification (verified: ssl_verify_result=0).
 authentik_outpost_proxy_host: "https://auth.gymb.souveredu.ch"
 authentik_outpost_proxy_token: "{{ _authentik.proxy_outpost_token }}"
-authentik_outpost_proxy_insecure: "true"
+authentik_outpost_proxy_insecure: "false"
 authentik_outpost_proxy_network: "proxy"