diff --git a/k8s/infra/monitoring/values.yaml b/k8s/infra/monitoring/values.yaml
index af6794f..630fa9c 100644
--- a/k8s/infra/monitoring/values.yaml
+++ b/k8s/infra/monitoring/values.yaml
@@ -26,6 +26,10 @@ grafana:
       auth_url: http://auth.lab.local/application/o/authorize/
       token_url: http://authentik.auth.svc.cluster.local:9000/application/o/token/
       api_url: http://authentik.auth.svc.cluster.local:9000/application/o/userinfo/
+      # Repli si l'utilisateur Authentik n'a pas d'email : sans ça Grafana tente un
+      # endpoint /emails inexistant chez Authentik → 404 « InternalError » au login.
+      login_attribute_path: preferred_username
+      email_attribute_path: email || preferred_username
       # Membre du groupe lab-admins → Admin, sinon Viewer
       role_attribute_path: contains(groups[*], 'lab-admins') && 'Admin' || 'Viewer'
       role_attribute_strict: false