diff --git a/infrastructure/authentik/manifests/cnpg-cluster.yaml b/infrastructure/authentik/manifests/cnpg-cluster.yaml
index b95b1c0..e2724b5 100644
--- a/infrastructure/authentik/manifests/cnpg-cluster.yaml
+++ b/infrastructure/authentik/manifests/cnpg-cluster.yaml
@@ -151,4 +151,5 @@ spec:
   replica:
     self: home
     primary: home
+    source: home  # required unconditionally by the admission webhook, even though home isn't actually replicating from anyone right now (self == primary)