diff --git a/apps/authentik/authentik-blueprints.yaml b/apps/authentik/authentik-blueprints.yaml
index cf62362..6684ac9 100644
--- a/apps/authentik/authentik-blueprints.yaml
+++ b/apps/authentik/authentik-blueprints.yaml
@@ -99,3 +99,81 @@ data:
           order: 5
         attrs:
           stage: !KeyOf matrix_invitation_redirect_stage
+  matrix-recovery-flow.yaml: |
+    # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
+    version: 1
+    metadata:
+      name: matrix-recovery-flow
+      labels:
+        blueprints.goauthentik.io/instantiate: "true"
+    entries:
+      # matrix-recovery existed but had zero stage bindings (dead flow), and the
+      # real login flow (default-authentication-flow, used by the MAS OAuth2
+      # provider's authentication_flow) didn't link to it at all - no "Forgot
+      # password?" link was ever shown. Reuses the same default-recovery-*
+      # stages the built-in default-recovery-flow already uses successfully,
+      # plus our own redirect stage instead of falling back to the authentik
+      # dashboard (blocked for type=external Matrix users).
+      - model: authentik_flows.flow
+        state: present
+        identifiers:
+          slug: matrix-recovery
+        id: matrix_recovery_flow
+        attrs:
+          designation: recovery
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_recovery_flow
+          order: 10
+        attrs:
+          stage: !Find [authentik_stages_identification.identificationstage, [name, default-recovery-identification]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_recovery_flow
+          order: 20
+        attrs:
+          stage: !Find [authentik_stages_email.emailstage, [name, default-recovery-email]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_recovery_flow
+          order: 30
+        attrs:
+          stage: !Find [authentik_stages_prompt.promptstage, [name, "Change your password"]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_recovery_flow
+          order: 40
+        attrs:
+          stage: !Find [authentik_stages_user_write.userwritestage, [name, default-recovery-user-write]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_recovery_flow
+          order: 100
+        attrs:
+          stage: !Find [authentik_stages_user_login.userloginstage, [name, default-recovery-user-login]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_recovery_flow
+          order: 110
+        attrs:
+          stage: !Find [authentik_stages_redirect.redirectstage, [name, matrix-invitation-redirect]]
+
+      # Wire the "Forgot password?" link on the real login flow used by MAS
+      - model: authentik_stages_identification.identificationstage
+        state: present
+        identifiers:
+          name: default-authentication-identification
+        attrs:
+          recovery_flow: !KeyOf matrix_recovery_flow