diff --git a/infrastructure/production/fleet/authentik/blueprints/brand.yaml b/infrastructure/production/fleet/authentik/blueprints/brand.yaml
index ef51dbd..3187d52 100644
--- a/infrastructure/production/fleet/authentik/blueprints/brand.yaml
+++ b/infrastructure/production/fleet/authentik/blueprints/brand.yaml
@@ -1,7 +1,8 @@
-# dezky branding for the default Authentik brand — title + signal-green accent.
-# (The "Powered by authentik" string lives in the web bundle and needs the
-# separate rebrand-web patch; this covers the colors/title that custom CSS can
-# reach.)
+# dezky branding for the default Authentik brand. branding_logo /
+# branding_default_flow_background are FILE-PATH fields (reject data URIs), so
+# the logo + carbon background are done via custom CSS (which allows data URIs).
+# The auth-flow title is set on the flow itself. ("Powered by authentik" footer
+# still needs the separate web-bundle patch.)
 version: 1
 metadata:
   name: dezky-brand
@@ -17,15 +18,24 @@ entries:
       branding_custom_css: |
         :root, :host {
           --ak-accent: #D4FF3A;
-          --ak-accent-secondary: #b8e020;
-          --pf-t--global--color--brand--default: #D4FF3A;
           --pf-v5-global--primary-color--100: #D4FF3A;
-          --pf-v5-global--primary-color--200: #b8e020;
           --pf-global--primary-color--100: #D4FF3A;
-          --pf-global--primary-color--200: #b8e020;
           --pf-global--link--Color: #D4FF3A;
-          --pf-global--active-color--100: #D4FF3A;
+          --ak-flow-background: #0A0A0A !important;
         }
+        /* dezky logo in place of the authentik wordmark */
+        .pf-c-brand, img.pf-c-brand, .ak-brand img, header img {
+          content: url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxODAiIGhlaWdodD0iNDgiIHZpZXdCb3g9IjAgMCAxODAgNDgiPjxyZWN0IHg9IjIiIHk9IjIiIHdpZHRoPSI0NCIgaGVpZ2h0PSI0NCIgcng9IjEzIiBmaWxsPSIjRjRGM0VFIi8+PHRleHQgeD0iMjQiIHk9IjM2IiBmb250LWZhbWlseT0iQXJpYWwsSGVsdmV0aWNhLHNhbnMtc2VyaWYiIGZvbnQtc2l6ZT0iMzIiIGZvbnQtd2VpZ2h0PSI3MDAiIGZpbGw9IiMwQTBBMEEiIHRleHQtYW5jaG9yPSJtaWRkbGUiPmQ8L3RleHQ+PGNpcmNsZSBjeD0iMzgiIGN5PSIxMiIgcj0iNC41IiBmaWxsPSIjRDRGRjNBIi8+PHRleHQgeD0iNTgiIHk9IjM0IiBmb250LWZhbWlseT0iQXJpYWwsSGVsdmV0aWNhLHNhbnMtc2VyaWYiIGZvbnQtc2l6ZT0iMjciIGZvbnQtd2VpZ2h0PSI3MDAiIGZpbGw9IiNGNEYzRUUiPmRlemt5PC90ZXh0Pjwvc3ZnPg==") !important;
+          height: 48px !important;
+          width: auto !important;
+        }
+        /* carbon background — remove the authentik forest */
+        .pf-c-background-image, .pf-c-background-image__src,
+        ak-flow-executor, .ak-flow-card-background {
+          background: #0A0A0A !important;
+        }
+        img.pf-c-background-image__src, .pf-c-background-image__src { display: none !important; }
+        /* signal-green primary button + links */
         .pf-c-button.pf-m-primary,
         .pf-v5-c-button.pf-m-primary,
         .pf-v6-c-button.pf-m-primary {
@@ -33,7 +43,11 @@ entries:
           color: #0A0A0A !important;
           border-color: #D4FF3A !important;
         }
-        a, .pf-c-button.pf-m-link, .pf-v5-c-button.pf-m-link {
-          color: #D4FF3A !important;
-        }
-        .pf-c-login__main, .ak-login-container { border-top: 3px solid #D4FF3A; }
+        a, .pf-c-button.pf-m-link, .pf-v5-c-button.pf-m-link { color: #D4FF3A !important; }
+
+  - model: authentik_flows.flow
+    state: present
+    identifiers:
+      slug: default-authentication-flow
+    attrs:
+      title: Welcome to Dezky