Skip to main content

Release 2025.8

note

2025.8 has not been released yet! We're publishing these release notes as a preview of what's to come, and for our awesome beta testers trying out release candidates.

To try out the release candidate, replace your Docker image tag with the latest release candidate number, such as 2025.8.0-rc1. You can find the latest one in the latest releases on GitHub. If you don't find any, it means we haven't released one yet.

Breaking changes​

Worker rework​

Upgrade instructions:

  • upgrade the authentik server first
  • inspect the celery task queue to check that all of them are done:
    • bash -c 'DJANGO_SETTINGS_MODULE=authentik.root.settings celery -A authentik.root.celery inspect active'
    • bash -c 'DJANGO_SETTINGS_MODULE=authentik.root.settings celery -A authentik.root.celery inspect scheduled'
    • bash -c 'DJANGO_SETTINGS_MODULE=authentik.root.settings celery -A authentik.root.celery inspect reserved'
  • once no more tasks, upgrade the worker
  • ???
  • profit

Renamed/removed settings​

The AUTHENTIK_WORKER__CONCURRENCY setting has been renamed AUTHENTIK_WORKER__PROCESSES. The old setting is still available as an alias and will be removed in a future release.

The following settings have been removed and no longer have an effect:

  • AUTHENTIK_BROKER__URL
  • AUTHENTIK_BROKER__TRANSPORT_OPTIONS
  • AUTHENTIK_RESULT_BACKEND__URL

Renamed/removed metrics​

The authentik_admin_workers metric has been renamed authentik_tasks_workers.

The following metrics have been removed:

  • authentik_system_tasks
  • authentik_system_tasks_time_seconds
  • authentik_system_tasks_status

Instead, the following metrics are now available:

  • authentik_tasks_total
  • authentik_tasks_errors_total
  • authentik_tasks_retries_total
  • authentik_tasks_rejected_total
  • authentik_tasks_in_progress
  • authentik_tasks_delayed_in_progress
  • authentik_tasks_duration_milliseconds

Docker image deprecation notice for beryju/authentik and beryju/authentik-*​

The beryju/authentik and beryju/authentik-* Docker images are no longer being updated. Users are now encouraged to use the following images:

  • Server image:

    • ghcr.io/goauthentik/server or authentik/server

  • Outpost images:

    • ghcr.io/goauthentik/ldap or authentik/ldap
    • ghcr.io/goauthentik/proxy or authentik/proxy
    • ghcr.io/goauthentik/rac or authentik/rac
    • ghcr.io/goauthentik/radius or authentik/radius

We recommend updating your Docker Compose files or other container configurations to use these new image paths.

New features​

Upgrading​

This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our Upgrade documentation.

warning

When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommended that you always upgrade any outposts at the same time you upgrade your authentik instance.

Docker Compose​

To upgrade, download the new Docker Compose file and update the Docker stack with the new version, using these commands:

wget -O docker-compose.yml https://goauthentik.io/version/2025.8/docker-compose.yml
docker compose up -d

The -O flag retains the downloaded file's name, overwriting any existing local file with the same name.

Kubernetes​

Upgrade the Helm Chart to the new version, using the following commands:

helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2025.8

Minor changes/fixes​

API Changes​