diff --git a/docs/adr/0005-personal-data-isolation-and-authentik-boundary.md b/docs/adr/0005-personal-data-isolation-and-authentik-boundary.md
index 09d438c..b29171f 100644
--- a/docs/adr/0005-personal-data-isolation-and-authentik-boundary.md
+++ b/docs/adr/0005-personal-data-isolation-and-authentik-boundary.md
@@ -109,7 +109,9 @@ Authentik configuration is codified in `terraform/authentik.tf`:
 
 `k8s/minio/hosting-ingress.yaml` defines the two ingress tiers:
 - **`minio-hosting-family` (Priority 100):**
-  - Path: `/family` (Prefix)
+  - Paths:
+    - `/family` (Prefix) -> Protected personal dashboards
+    - `/outpost.goauthentik.io` (Prefix) -> Authentik ForwardAuth OAuth callback & session negotiation
   - Middlewares: `auth-authentik-forwardauth@kubernetescrd,minio-hosting-add-prefix@kubernetescrd`
 - **`minio-hosting` (Priority 10):**
   - Path: `/` (Prefix)