diff --git a/butane/monitor.yaml b/butane/monitor.yaml.tftpl
similarity index 73%
rename from butane/monitor.yaml
rename to butane/monitor.yaml.tftpl
index 397904a..eca5837 100644
--- a/butane/monitor.yaml
+++ b/butane/monitor.yaml.tftpl
@@ -3,6 +3,12 @@ version: 1.0.0
 
 # Dozzle log viewer hub.
 #
+# Rendered with templatefile(): the OIDC client id and secret come from
+# Infisical (DOZZLE_OIDC_CLIENT_ID / DOZZLE_OIDC_CLIENT_SECRET in
+# secrets.tmpl), so neither is committed. The secret does still land in
+# plaintext in the rendered Ignition snippet on the node, and in
+# "systemctl show dozzle.service" -- same caveat as headscale_authkey.
+#
 # Aggregates container logs from the dozzle agents running on the other Flatcar
 # VMs (see the dozzle-agent units in the other butane configs) and, via the
 # local socket, from this host's own containers. Reachable on :8080.
@@ -41,6 +47,20 @@ systemd:
         Environment="DOZZLE_HOSTNAME=Oswald Logs"
         Environment="DOZZLE_ENABLE_MCP=true"
         Environment="DOZZLE_REMOTE_AGENT=192.168.7.60:7007|oswald-runner|Goose,192.168.7.61:7007|ai|Goose,192.168.7.62:7007|oswl-connector|Goose,192.168.7.64:7007|cisa-kev-rss|Goose"
+        # OIDC via Authelia. Dozzle builds its redirect from the incoming
+        # request, so the proxy in front must pass the real Host and
+        # X-Forwarded-Proto; the URI to register in Authelia is
+        # https://dozzle.oswaldtheotter.net/api/auth/callback
+        # Authelia publishes no "roles"/"dozzle_roles" claim, only "groups",
+        # so the groups claim is requested as an extra scope and pointed at
+        # directly -- otherwise Dozzle finds no roles and nobody gets admin.
+        Environment="DOZZLE_AUTH_PROVIDER=oidc"
+        Environment="DOZZLE_AUTH_OIDC_ISSUER=https://auth.atlashorizon.net"
+        Environment="DOZZLE_AUTH_OIDC_CLIENT_ID=${dozzle_oidc_client_id}"
+        Environment="DOZZLE_AUTH_OIDC_CLIENT_SECRET=${dozzle_oidc_client_secret}"
+        Environment="DOZZLE_AUTH_OIDC_NAME=AtlasHorizon"
+        Environment="DOZZLE_AUTH_OIDC_SCOPES=dozzle_roles"
+        Environment="DOZZLE_AUTH_OIDC_ROLES_CLAIM=dozzle_roles"
         # Pulled up front so a slow first pull is not mistaken for a hung unit.
         ExecStartPre=/usr/bin/docker pull amir20/dozzle:v11.1.1
         # Leading "-" so a missing container is not a failure.
@@ -58,6 +78,13 @@ systemd:
           -e DOZZLE_HOSTNAME \
           -e DOZZLE_ENABLE_MCP \
           -e DOZZLE_REMOTE_AGENT \
+          -e DOZZLE_AUTH_PROVIDER \
+          -e DOZZLE_AUTH_OIDC_ISSUER \
+          -e DOZZLE_AUTH_OIDC_CLIENT_ID \
+          -e DOZZLE_AUTH_OIDC_CLIENT_SECRET \
+          -e DOZZLE_AUTH_OIDC_NAME \
+          -e DOZZLE_AUTH_OIDC_SCOPES \
+          -e DOZZLE_AUTH_OIDC_ROLES_CLAIM \
           amir20/dozzle:v11.1.1
         ExecStop=/usr/bin/docker stop dozzle
         Restart=always
diff --git a/secrets.tmpl b/secrets.tmpl
index fb17cf8..dc4c417 100644
--- a/secrets.tmpl
+++ b/secrets.tmpl
@@ -15,6 +15,8 @@
   {{- if eq $secret.Key "LITELLM_MASTER_KEY" }}"litellm_master_key": "{{$secret.Value}}",{{ end }}
   {{- if eq $secret.Key "LITELLM_SALT_KEY" }}"litellm_salt_key": "{{$secret.Value}}",{{ end }}
   {{- if eq $secret.Key "HEADSCALE_AUTHKEY" }}"headscale_authkey": "{{$secret.Value}}",{{ end }}
+  {{- if eq $secret.Key "DOZZLE_OIDC_CLIENT_ID" }}"dozzle_oidc_client_id": "{{$secret.Value}}",{{ end }}
+  {{- if eq $secret.Key "DOZZLE_OIDC_CLIENT_SECRET" }}"dozzle_oidc_client_secret": "{{$secret.Value}}",{{ end }}
   {{- end }}
   "_sentinel": "1"
 }
diff --git a/terraform.tfvars b/terraform.tfvars
index 627b4b1..39dc9eb 100644
--- a/terraform.tfvars
+++ b/terraform.tfvars
@@ -249,7 +249,7 @@ nodes = {
         cores            = 2
         disk_size        = 32
         qemu_guest_agent = false
-        butane_file      = "butane/monitor.yaml"
+        butane_file      = "butane/monitor.yaml.tftpl"
       }
       # CISA Known Exploited Vulnerabilities catalog as an RSS feed.
       # Stateless container; feed at :3000/rss.