diff --git a/README.md b/README.md
index 956e4e3..1d471af 100644
--- a/README.md
+++ b/README.md
@@ -146,7 +146,7 @@ Or point any OpenAI client at it:
 `OpenAI(base_url=f"https://gateway.{DOMAIN}/v1", api_key=TOKEN)`.
 
 The token is yours, so rate limits and usage are attributed to you. Access tokens last
-`authentik.oauthApp.accessTokenValidity` (30 days by default); the device grant also
+`authentik.oauthApp.accessTokenValidity` (8 hours by default); the device grant also
 returns a refresh token, valid for `refreshTokenValidity`, so a client can renew without
 a second browser approval. A model that has scaled to zero takes a minute or two to answer
 the first request.
diff --git a/templates/authentik-blueprints-secret.yaml b/templates/authentik-blueprints-secret.yaml
index de0f452..1f4f2df 100644
--- a/templates/authentik-blueprints-secret.yaml
+++ b/templates/authentik-blueprints-secret.yaml
@@ -51,19 +51,19 @@ stringData:
           client_type: public
           client_id: {{ .Values.authentik.oauthApp.clientId }}
           client_secret: {{ .Values.authentik.oauthApp.clientSecret }}
+          {{- /* Only what is actually used: authorization_code for OpenWebUI's browser
+          login, device_code + refresh_token for API clients. Every other grant is
+          reachable surface on a public client for no benefit. */}}
           grant_types:
             - authorization_code
-            - hybrid
-            - implicit
-            - client_credentials
-            - password
             - urn:ietf:params:oauth:grant-type:device_code
             - refresh_token
           redirect_uris:
             - url: "https://openwebui.{{ .Values.envoy.baseDomain }}/.*"
               matching_mode: regex
               redirect_uri_type: authorization
-          access_token_validity: {{ .Values.authentik.oauthApp.accessTokenValidity | default "days=30" }}
+          access_code_validity: {{ .Values.authentik.oauthApp.accessCodeValidity | default "minutes=10" }}
+          access_token_validity: {{ .Values.authentik.oauthApp.accessTokenValidity | default "hours=8" }}
           refresh_token_validity: {{ .Values.authentik.oauthApp.refreshTokenValidity | default "days=365" }}
           signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
           encryption_key: 
diff --git a/values.yaml b/values.yaml
index a09c54d..cfb461d 100644
--- a/values.yaml
+++ b/values.yaml
@@ -137,5 +137,13 @@ authentik:
     name: vllm
     clientId:
     clientSecret:
-    accessTokenValidity: "days=30"
+    # Lifetime of the device code and the authorization code.
+    accessCodeValidity: "minutes=10"
+    accessTokenValidity: "hours=8"
     refreshTokenValidity: "days=365"
+  serviceAccount:
+    # Gates the authentik-remote-cluster subchart (aliased `serviceAccount` in the
+    # authentik chart's dependencies), which would bind the worker to a Role granting
+    # get/create/delete/list/patch on namespace secrets, deployments and httproutes.
+    # Only needed for managed outposts, which this deployment does not use.
+    create: false