diff --git a/kubernetes/main/apps/security/authentik/app/authentik-secret.yaml b/kubernetes/main/apps/security/authentik/app/authentik-secret.yaml
index 8e84fbad3f..836a565e6c 100644
--- a/kubernetes/main/apps/security/authentik/app/authentik-secret.yaml
+++ b/kubernetes/main/apps/security/authentik/app/authentik-secret.yaml
@@ -27,6 +27,7 @@ spec:
         AUTHENTIK_STORAGE__MEDIA__S3__BUCKET_NAME: "{{ .authentik_AWS_BUCKET_NAME }}"
         AUTHENTIK_STORAGE__MEDIA__S3__REGION: "{{ .authentik_AWS_REGION }}"
         AUTHENTIK_STORAGE__MEDIA__S3__ENDPOINT: "{{ .authentik_S3_ENDPOINT }}"
+        AUTHENTIK_STORAGE__MEDIA__S3__CUSTOM_DOMAIN: "{{ .authentik_S3_CUSTOM_ENDPOINT }}"
 
         AUTHENTIK_BOOTSTRAP_EMAIL: "{{ .authentik_BOOTSTRAP_EMAIL }}"
         AUTHENTIK_BOOTSTRAP_PASSWORD: "{{ .authentik_BOOTSTRAP_PASSWORD }}"
diff --git a/kubernetes/main/apps/security/authentik/cdn/helm-release.yaml b/kubernetes/main/apps/security/authentik/cdn/helm-release.yaml
index 5ada13e8f9..3bfbbfe968 100644
--- a/kubernetes/main/apps/security/authentik/cdn/helm-release.yaml
+++ b/kubernetes/main/apps/security/authentik/cdn/helm-release.yaml
@@ -35,7 +35,7 @@ spec:
           main:
             image:
               repository: ghcr.io/szinn/s3-cdn
-              tag: latest@sha256:c237637eab22d7f0605b8c48066bc2b91f302de87f8a3d0c5d4140aeed07f593
+              tag: 0.2.0
               pullPolicy: Always
             args:
               - server
@@ -55,7 +55,7 @@ spec:
         enabled: true
         className: nginx
         annotations:
-          ingress.home.arpa/type: "internal"
+          ingress.home.arpa/type: external
         hosts:
           - host: "{{ .Release.Name }}.${SECRET_DOMAIN_NAME}"
             paths: