diff --git a/oci/authentik-ldap-outpost/contacts.yaml b/oci/authentik-ldap-outpost/contacts.yaml
new file mode 100644
index 000000000..a0665c00a
--- /dev/null
+++ b/oci/authentik-ldap-outpost/contacts.yaml
@@ -0,0 +1,7 @@
+notify:
+  emails:
+    - identity.charmers@lists.launchpad.net
+  mattermost-channels:
+    - ofi4for9obfq8m978h318x56ar
+maintainers:
+  - canonical-iam
diff --git a/oci/authentik-ldap-outpost/documentation.yaml b/oci/authentik-ldap-outpost/documentation.yaml
new file mode 100644
index 000000000..bcbaa6dd2
--- /dev/null
+++ b/oci/authentik-ldap-outpost/documentation.yaml
@@ -0,0 +1,46 @@
+version: 2
+application: authentik-ldap-outpost
+description: |
+  The authentik LDAP outpost is an Identity Provider outpost that allows authentik
+  to act as an LDAP server. It serves as an LDAP interface for your authentik instance,
+  enabling legacy applications that do not support modern protocols like OIDC or SAML
+  to authenticate users.
+website: https://goauthentik.io
+issues: https://github.com/canonical/authentik-ldap-outpost-rock/issues
+source-code: https://github.com/canonical/authentik-ldap-outpost-rock
+
+docker:
+  parameters: >-
+    -p 3389:3389
+    -p 6636:6636
+    -e AUTHENTIK_HOST=http://authentik-server:9000
+    -e AUTHENTIK_TOKEN=your-ldap-outpost-token
+  run_conclusion: |
+    The authentik LDAP outpost starts and serves LDAP on port `3389` and LDAPS on port `6636`.
+    Access the LDAP outpost server at `ldap://localhost:3389`.
+
+config:
+  AUTHENTIK_HOST:
+    type: env
+    description: The URL of the authentik server that the outpost connects to (e.g., `https://authentik.company` or `http://authentik-server:9000`).
+  AUTHENTIK_TOKEN:
+    type: env
+    description: The token used to authenticate with the core authentik server. Create an outpost in the authentik Admin UI to generate this token.
+  AUTHENTIK_INSECURE:
+    type: env
+    description: Set to "true" to disable TLS certificate verification when connecting to the authentik server (e.g., when using self-signed certificates).
+    default: "false"
+  AUTHENTIK_LISTEN__LDAP:
+    type: env
+    description: Internal address and port for the LDAP server to listen on.
+    default: "[::]:3389"
+  AUTHENTIK_LISTEN__LDAPS:
+    type: env
+    description: Internal address and port for the LDAPS server to listen on.
+    default: "[::]:6636"
+  '`-p <port>:3389`':
+    type: port
+    description: Expose the LDAP port 3389 on the host's `<port>`.
+  '`-p <port>:6636`':
+    type: port
+    description: Expose the LDAPS port 6636 on the host's `<port>`.
diff --git a/oci/authentik-ldap-outpost/image.yaml b/oci/authentik-ldap-outpost/image.yaml
new file mode 100644
index 000000000..3debbfd5c
--- /dev/null
+++ b/oci/authentik-ldap-outpost/image.yaml
@@ -0,0 +1,19 @@
+version: 2
+upload:
+  - source: "canonical/authentik-ldap-outpost-rock"
+    commit: 7615949649e03d73d217b08494f9f3295550dd01
+    directory: .
+    release:
+      # Upstream does not follow semver; a new version is released every 3 months.
+      # Upstream versions have a patch version digit, which we are dropping (upstream
+      # follows the same convention on Docker Hub).
+      2026.5-26.04:
+        risks:
+          - edge
+        end-of-life: "2026-09-29T00:00:00Z"
+    ignored-vulnerabilities:
+      # Both CVEs are fixed upstream well before the version we build (2026.5.3);
+      # trivy matches them because Go stamps the main module of an in-tree build
+      # with a pseudo-version (v0.0.0-<ts>-<sha>) instead of the release version.
+      - CVE-2024-42490  # goauthentik.io: Insufficient authorization on several API endpoints. Fixed upstream in 2024.4.4/2024.6.4. https://github.com/goauthentik/authentik/security/advisories/GHSA-qxqc-27pr-wgc8
+      - CVE-2024-23647  # goauthentik.io: PKCE downgrade attack. Fixed upstream in 2023.8.7/2023.10.7. https://github.com/goauthentik/authentik/security/advisories/GHSA-mrx3-gxjx-hjqj