diff --git a/stacks/owntracks/.terraform.lock.hcl b/stacks/owntracks/.terraform.lock.hcl
index a1ca7484..fabbc047 100644
--- a/stacks/owntracks/.terraform.lock.hcl
+++ b/stacks/owntracks/.terraform.lock.hcl
@@ -24,6 +24,14 @@ provider "registry.terraform.io/cloudflare/cloudflare" {
   ]
 }
 
+provider "registry.terraform.io/goauthentik/authentik" {
+  version     = "2024.12.1"
+  constraints = "~> 2024.10"
+  hashes = [
+    "h1:roBMd+gi+TGgikH/bMzEI8JfvJiMAQWt+8FmokCrQIs=",
+  ]
+}
+
 provider "registry.terraform.io/hashicorp/helm" {
   version = "3.1.1"
   hashes = [
diff --git a/stacks/owntracks/main.tf b/stacks/owntracks/main.tf
index 5af77559..40106565 100644
--- a/stacks/owntracks/main.tf
+++ b/stacks/owntracks/main.tf
@@ -146,7 +146,7 @@ resource "kubernetes_deployment" "owntracks" {
           image = "owntracks/recorder:1.0.1"
           name  = "owntracks"
           port {
-            name           = "https"
+            name           = "http"
             container_port = 8083
           }
           env {
@@ -202,8 +202,11 @@ resource "kubernetes_service" "owntracks" {
       app = "owntracks"
     }
     port {
-      name        = "https"
-      port        = 443
+      # Recorder listens plain HTTP on 8083 (OTR_PORT=0 disables HTTPS).
+      # Port name/number drive Traefik's backend-scheme inference — must be
+      # http/80 so it doesn't try TLS against a plain socket (previous 500s).
+      name        = "http"
+      port        = 80
       target_port = 8083
       protocol    = "TCP"
     }
@@ -216,7 +219,7 @@ module "ingress" {
   namespace       = kubernetes_namespace.owntracks.metadata[0].name
   name            = "owntracks"
   tls_secret_name = var.tls_secret_name
-  port            = 443
+  port            = 80
   extra_annotations = {
     "traefik.ingress.kubernetes.io/router.middlewares" = "owntracks-basic-auth@kubernetescrd,traefik-rate-limit@kubernetescrd,traefik-csp-headers@kubernetescrd,traefik-crowdsec@kubernetescrd"
     "gethomepage.dev/enabled"                          = "true"
diff --git a/stacks/owntracks/providers.tf b/stacks/owntracks/providers.tf
index b337a2e9..012af700 100644
--- a/stacks/owntracks/providers.tf
+++ b/stacks/owntracks/providers.tf
@@ -9,6 +9,10 @@ terraform {
       source  = "cloudflare/cloudflare"
       version = "~> 4"
     }
+    authentik = {
+      source  = "goauthentik/authentik"
+      version = "~> 2024.10"
+    }
   }
 }