diff --git a/apps/authentik/authentik-blueprints.yaml b/apps/authentik/authentik-blueprints.yaml
index 661e578..3ba2b1a 100644
--- a/apps/authentik/authentik-blueprints.yaml
+++ b/apps/authentik/authentik-blueprints.yaml
@@ -467,17 +467,9 @@ data:
           policy_engine_mode: any
           open_in_new_tab: false
 
-      # Rollen/Abschottung (#0049). Namen müssen exakt den Wiki.js-Gruppen
-      # entsprechen — sie kommen über den profile->groups-Claim automatisch mit.
-      # Mitglieder werden in der Authentik-UI zugewiesen (sorb), nicht hier.
-      - model: authentik_core.group
-        state: present
-        identifiers:
-          name: wiki-admin
-      - model: authentik_core.group
-        state: present
-        identifiers:
-          name: wiki-betrieb
+      # Rollen (#0049): Admin = bestehende Gruppe `authentik Admins` (liest+schreibt
+      # alles). `wiki-anwender` = kuratierte Leser von /anwender. Beide kommen über
+      # den profile->groups-Claim in Wiki.js an; Mitglieder pflegt sorb in Authentik.
       - model: authentik_core.group
         state: present
         identifiers:
diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
index 1efccb8..9ce967f 100644
--- a/apps/production/kustomization.yaml
+++ b/apps/production/kustomization.yaml
@@ -55,6 +55,7 @@ resources:
   - concierge-bot.yaml
   # Wiki.js (Plattform-Wiki, ADR-0014, #0048)
   - wikijs-postgres-secret.yaml   # SOPS, von sorb angelegt
+  - wikijs-admin-secret.yaml      # SOPS, randomisiert — Bootstrap durch den Konfig-Job
   - wikijs-postgres.yaml
   - wikijs.yaml
   - wiki-ingress.yaml
diff --git a/apps/production/wikijs-admin-secret.yaml b/apps/production/wikijs-admin-secret.yaml
new file mode 100644
index 0000000..20d1b93
--- /dev/null
+++ b/apps/production/wikijs-admin-secret.yaml
@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    email: ENC[AES256_GCM,data:VXwOHfp9spepzaQ6HrXyeDTITxKWSiEdV3u9pA==,iv:KC6SzHMOELHlFIcM0xW8wXZ+lG61y3arFt8DZMTtm9g=,tag:C5KxglXJzfG86+J4O+6y6g==,type:str]
+    password: ENC[AES256_GCM,data:+r73YasvUGbuEYrcqR1WiVzXunnk7QzTnemu2wtzoQb9T30PA1+Ea/Lap9chSmmR,iv:UT1nDAdoi8jDRG0GN1Tr+ZJbDyHhV0X09HvLxkmOwxQ=,tag:i1+ogn8IjW33hbfKl4t5gQ==,type:str]
+kind: Secret
+metadata:
+    name: wikijs-admin-secret
+    namespace: matrix
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKMklFSTZyTTNuREExaW5h
+            ZXFoeS8yMFZvSjFpOXhjQ3JpdmtqNVh4VDN3Ci9jNnd5dFpUdGtlVFFubkRmUjRD
+            WnBEaVVSbEtsakJQMzBJOFI5bDVSR1EKLS0tIEo2NjU0SldVMGg0LzZBaXR2OXFy
+            MzZTRURZYWZ6VDlaSTVramI5aGlSU0kKvY0+xfsUknIlMxTT4zjM40P0LK05Dp2S
+            ufEZU3+IamAdxVhdwaJmT8eEJvd/Q5off35D6OzylZPzdlsrqn5wGg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-12T21:07:47Z"
+    mac: ENC[AES256_GCM,data:O/w/lIrlbyclnk6MiGcsg0OgMEjMoHwqYjKLCU53G+mlk+wecuL13MeMTbHW1yf03/dieCcVzYwSspRZyQGmZevO4/QCefN5mVWlzxLPSLmRmOeEA7IJxGqiLXn/GliVfdpvSlifRM0CxfrCWGZ1iBWQqxPbJD9tZRhmaytfHXY=,iv:2adSCqQHm9KBCOHAH0EJ0Un42mx42CqIgELfe7NgP4I=,tag:no+CjJ0Fs2y58sava9Ieyw==,type:str]
+    version: 3.13.3