diff --git a/apps/kubernetes-dashboard/resources/admin-user-binding.yaml b/apps/kubernetes-dashboard/resources/admin-user-binding.yaml
new file mode 100644
index 0000000..45de918
--- /dev/null
+++ b/apps/kubernetes-dashboard/resources/admin-user-binding.yaml
@@ -0,0 +1,14 @@
+# Site policy: the Authentik-protected Dashboard proxy acts as cluster-admin.
+# The chart owns the admin-user ServiceAccount and rotates its projected token.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: admin-user
+  namespace: kubernetes-dashboard
diff --git a/apps/kubernetes-dashboard/resources/kustomization.yaml b/apps/kubernetes-dashboard/resources/kustomization.yaml
new file mode 100644
index 0000000..3e6d625
--- /dev/null
+++ b/apps/kubernetes-dashboard/resources/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- admin-user-binding.yaml
diff --git a/apps/kubernetes-dashboard/values.yaml b/apps/kubernetes-dashboard/values.yaml
new file mode 100644
index 0000000..afa1ab4
--- /dev/null
+++ b/apps/kubernetes-dashboard/values.yaml
@@ -0,0 +1,64 @@
+app:
+  security:
+    existingCsrfSecret: true
+    podDisruptionBudget:
+      enabled: true
+      maxUnavailable: 1
+  settings:
+    global:
+      clusterName: arschrock
+      defaultNamespace: default
+
+auth:
+  scaling:
+    replicas: 2
+    revisionHistoryLimit: 3
+  containers:
+    resources:
+      requests: {cpu: 25m, memory: 200Mi}
+      limits: {cpu: 250m, memory: 400Mi}
+api:
+  scaling:
+    replicas: 2
+    revisionHistoryLimit: 3
+  containers:
+    resources:
+      requests: {cpu: 25m, memory: 200Mi}
+      limits: {cpu: 250m, memory: 400Mi}
+web:
+  scaling:
+    replicas: 2
+    revisionHistoryLimit: 3
+  containers:
+    resources:
+      requests: {cpu: 25m, memory: 200Mi}
+      limits: {cpu: 250m, memory: 400Mi}
+metricsScraper:
+  scaling:
+    revisionHistoryLimit: 3
+  containers:
+    resources:
+      requests: {cpu: 25m, memory: 200Mi}
+      limits: {cpu: 250m, memory: 400Mi}
+kong:
+  replicaCount: 2
+  resources:
+    requests: {cpu: 25m, memory: 256Mi}
+    limits: {cpu: 500m, memory: 512Mi}
+  proxy:
+    type: ClusterIP
+    http:
+      enabled: false
+    tls:
+      enabled: true
+cert-manager:
+  enabled: false
+nginx:
+  enabled: false
+metrics-server:
+  enabled: false
+
+authProxy:
+  enabled: true
+  serviceAccountName: admin-user
+  traefikNamespace: default
diff --git a/bootstrap/kubernetes-dashboard-project.yaml b/bootstrap/kubernetes-dashboard-project.yaml
new file mode 100644
index 0000000..7cf1c6c
--- /dev/null
+++ b/bootstrap/kubernetes-dashboard-project.yaml
@@ -0,0 +1,34 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: kubernetes-dashboard
+  namespace: argocd
+spec:
+  sourceRepos:
+  - https://brunner.ninja/charts
+  - https://code.brunner.ninja/feedc0de/homelab-gitops.git
+  destinations:
+  - server: https://kubernetes.default.svc
+    namespace: kubernetes-dashboard
+  clusterResourceWhitelist:
+  - group: rbac.authorization.k8s.io
+    kind: ClusterRole
+  - group: rbac.authorization.k8s.io
+    kind: ClusterRoleBinding
+  namespaceResourceWhitelist:
+  - group: ""
+    kind: ConfigMap
+  - group: ""
+    kind: Service
+  - group: ""
+    kind: ServiceAccount
+  - group: apps
+    kind: Deployment
+  - group: rbac.authorization.k8s.io
+    kind: Role
+  - group: rbac.authorization.k8s.io
+    kind: RoleBinding
+  - group: policy
+    kind: PodDisruptionBudget
+  - group: networking.k8s.io
+    kind: NetworkPolicy
diff --git a/bootstrap/kubernetes-dashboard.yaml b/bootstrap/kubernetes-dashboard.yaml
new file mode 100644
index 0000000..abde63d
--- /dev/null
+++ b/bootstrap/kubernetes-dashboard.yaml
@@ -0,0 +1,32 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kubernetes-dashboard
+  namespace: argocd
+spec:
+  project: kubernetes-dashboard
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: kubernetes-dashboard
+    targetRevision: 7.14.0
+    helm:
+      releaseName: kubernetes-dashboard
+      valueFiles:
+      - $values/apps/kubernetes-dashboard/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    path: apps/kubernetes-dashboard/resources
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kubernetes-dashboard
+  syncPolicy:
+    automated:
+      enabled: false
+      prune: false
+      selfHeal: false
+    syncOptions:
+    - CreateNamespace=true
+    - ServerSideApply=true
diff --git a/bootstrap/kustomization.yaml b/bootstrap/kustomization.yaml
index 3bdef0e..360e7dc 100644
--- a/bootstrap/kustomization.yaml
+++ b/bootstrap/kustomization.yaml
@@ -59,6 +59,8 @@ resources:
 - diun-project.yaml
 - diun.yaml
 - influxdb2.yaml
+- kubernetes-dashboard-project.yaml
+- kubernetes-dashboard.yaml
 - brunner-ninja.yaml
 - coturn.yaml
 - flaresolverr.yaml