diff --git a/serverAppConfigs-docs/Dankserver/Jellyfin.md b/serverAppConfigs-docs/Dankserver/Jellyfin.md
index ff4c946..02c4d4f 100644
--- a/serverAppConfigs-docs/Dankserver/Jellyfin.md
+++ b/serverAppConfigs-docs/Dankserver/Jellyfin.md
@@ -55,6 +55,47 @@ Client access paths and the public-exposure policy (auth wall required before
 any public vhost; Plex-style claim tokens do not exist here — Jellyfin uses its
 own users/API keys) follow the fleet [[Authentik]]/[[Anubis]] chain pattern.
 
+## Authentik LDAP authentication (2026-09-25)
+
+Jellyfin has no native external-auth, so it authenticates users through the
+**LDAP-Auth plugin** (`jellyfin-plugin-ldapauth`) against an [[Authentik]] LDAP
+provider. A user logs in with their **authentik username + password**; the
+plugin binds as a service account, searches the directory, and rebinds as the
+user to verify the password.
+
+**authentik side** (on Dankclaw):
+- LDAP provider `Jellyfin LDAP` (Base DN `dc=franksdank,dc=cloud`, bind/search
+  mode `direct`) + application `Jellyfin`.
+- LDAP outpost `Jellyfin LDAP Outpost` → container `authentik-outpost-ldap`
+  (quadlet `dankclaw/authentik/quadlet/authentik-outpost-ldap.container`),
+  publishing `389`/`636` on the Dankclaw host for cross-host binds.
+- Service account `svc-jellyfin-ldap` (DN
+  `cn=svc-jellyfin-ldap,ou=users,dc=franksdank,dc=cloud`).
+- Access groups `jellyfin_users` (search filter
+  `(memberOf=cn=jellyfin_users,ou=groups,dc=franksdank,dc=cloud)`) and
+  `jellyfin_admins` (admin filter `(cn=jellyfin_admins)`). Add a user to
+  `jellyfin_users` to grant them Jellyfin access; `jellyfin_admins` grants
+  the Jellyfin admin role.
+
+**Jellyfin side** (plugin config, set via admin → Plugins → LDAP-Auth):
+- Server `192.168.0.143:389` (plain LDAP over the trusted LAN), Base DN
+  `dc=franksdank,dc=cloud`, bind user = the service-account DN, search
+  attributes `uid,cn,mail,displayName`, uid attr `uid`, username attr `cn`,
+  `CreateUsersFromLdap=true`, all folders enabled.
+
+**Gotcha — the bind credential is a PASSWORD, not a token.** The LDAP bind is
+verified by authentik's default authentication flow (standard-password
+backend). The service account must have a password set (admin → user →
+Recovery → Set password); an API/app token is *not* accepted as the bind
+password and the bind fails with `flow error password: Invalid`. The
+service-account password is stored only in the Jellyfin plugin config (the
+`LdapBindPassword` field) — it is never committed to this repo.
+
+**Verification (2026-09-25):** `ldapsearch` bind + the `jellyfin_users`
+search both succeed from Dankclaw; a real user (`alex`, in `jellyfin_users`)
+logged into the web UI with their authentik password and the plugin created
+the matching Jellyfin user.
+
 ## Configuration workflow
 
 1. Create libraries pointing at `/data` folders (movies, shows, audio).