diff --git a/src/content/posts/authentik-major-upgrade-gotchas.md b/src/content/posts/authentik-major-upgrade-gotchas.md
index 2f3a7e8..8d0d4fd 100644
--- a/src/content/posts/authentik-major-upgrade-gotchas.md
+++ b/src/content/posts/authentik-major-upgrade-gotchas.md
@@ -13,6 +13,41 @@ bringing it all the way to **2026.8.1** in one sitting, and everything that
 broke along the way — especially the one mistake that took Single Sign-On
 completely offline and made every internal app ask for a password again.
 
+## What is authentik, and why run it?
+
+authentik is an open-source **identity provider (IdP)** — the thing that answers
+one question over and over: *"who is this person, and are they allowed in?"*
+Think of it as the front door to a whole building of apps. Instead of every
+app running its own username/password screen (and its own list of bugs, its own
+"forgot password" flow, its own 2FA), you make all of them ask authentik instead.
+
+It speaks the protocols that matter for real deployments:
+
+- **OIDC / OAuth2** — the modern single sign-on standard (what "Sign in with
+  Google" uses under the hood).
+- **SAML** — the enterprise standard (for tools like Grafana, Jira, or any
+  legacy line-of-business app).
+- **LDAP** — so older clients and NAS boxes that only know LDAP can join too.
+- **Proxy / forward-auth** — it sits in front of an app via a reverse proxy and
+  gatekeeps access before a request ever reaches the app.
+
+The practical benefits, in order of how much they actually matter:
+
+1. **One login for everything.** Log in once, move freely between every app.
+   Users stop juggling a dozen passwords (and the support tickets that go with
+   them).
+2. **One place to lock things down.** MFA, password policy, session limits, and
+   account recovery live in authentik once — not re-implemented per app.
+3. **One place to audit.** Every login, on every app, for every user, in one
+   log. That's the difference between "we think nothing happened" and "we can
+   prove it" when a question comes up.
+4. **Self-contained and self-hosted.** You own the data. No per-user SaaS fees
+   that scale with your headcount, no lock-in — it's AGPL, runs in Docker.
+
+For a small business or a solo operator running twenty-something services
+(email, dashboards, NAS apps, internal tools), authentik is the difference
+between "every app has its own flimsy password" and "one hardened front door."
+
 ## Why upgrade at all
 
 Version 2025.8.3 wasn't broken. But it had fallen far enough behind that a
@@ -191,4 +226,19 @@ The lesson worth carrying: a major-version upgrade on auth infrastructure is
 roughly 10% "change the image tag" and 90% "the data model, storage layout,
 and proxy rules all shifted underneath you." Back up, go one version at a time,
 and when something behaves in a way that makes no sense, read the field name
-again before you reach for another config.
\ No newline at end of file
+again before you reach for another config.
+
+---
+
+## Want single sign-on for your business?
+
+If you're running several internal apps — a dashboard, an email server, a help
+desk, a file server — and your team is still logging into each one separately
+(or reusing the same password everywhere), I set up and maintain exactly this
+kind of infrastructure. I'll deploy authentik, wire it to your existing apps,
+add MFA, and make sure "log in once" actually works — then leave you with a
+handover so you're never locked in.
+
+Reach me at [me@hoelee.com](mailto:me@hoelee.com) or WhatsApp
+[+60 12-797 2969](https://wa.me/60127972969), or see what I do at
+[hoelee.com](https://hoelee.com).
\ No newline at end of file
diff --git a/src/content/posts/zh/authentik-major-upgrade-gotchas.md b/src/content/posts/zh/authentik-major-upgrade-gotchas.md
index 5dbc43f..e85467c 100644
--- a/src/content/posts/zh/authentik-major-upgrade-gotchas.md
+++ b/src/content/posts/zh/authentik-major-upgrade-gotchas.md
@@ -12,6 +12,36 @@ tags: [authentik, sso, docker, portainer, self-hosting, oidc, upgrade]
 沿途每一步坏掉的地方——尤其是我犯的那个让单点登录彻底瘫痪、逼每个内部
 应用都重新要密码的错误。
 
+## 什么是 authentik，为什么要用它？
+
+authentik 是一个开源的**身份提供商（IdP）**——反复回答同一个问题的那个组件：
+*「这个人是谁，允许他进来吗？」* 你可以把它想成整栋应用大楼的前门。与其让每个
+应用都跑自己那套用户名/密码页面（还有自己那一堆 bug、自己的「忘记密码」流程、
+自己的二次验证），不如让所有应用都来问 authentik。
+
+它支持真实部署里真正用得上的协议：
+
+- **OIDC / OAuth2** —— 现代单点登录标准（「用 Google 登录」底层用的就是它）。
+- **SAML** —— 企业标准（Grafana、Jira，或任何老旧的业务系统都能接）。
+- **LDAP** —— 让只认 LDAP 的老客户端和 NAS 也能加入。
+- **Proxy / forward-auth** —— 通过反向代理挡在应用前面，请求还没碰到应用就已经
+  完成了鉴权。
+
+实际的好处，按重要性排序：
+
+1. **一个登录通行所有。** 登录一次，在每一个应用之间自由穿梭。用户不用再记一打
+   密码（也不用再陪着一堆由此而来的客服工单）。
+2. **一个地方收紧安全。** MFA、密码策略、会话限制、账户找回，都在 authentik 里
+   配一次——而不是每个应用各自重新实现一遍。
+3. **一个地方做审计。** 每一个登录、每一个应用、每一个用户，都在同一个日志里。
+   出问题时，这就是「我们以为没事」和「我们有证据」之间的区别。
+4. **自包含、可自托管。** 数据归你所有。没有按人头收费、随团队规模膨胀的 SaaS
+   费，也没有锁定——它是 AGPL 许可，跑在 Docker 里。
+
+对一个运营着二十几个服务（邮箱、仪表盘、NAS 应用、内部工具）的小企业或独立
+开发者来说，authentik 就是「每个应用各有一个脆弱密码」和「一道加固过的前门」之间
+的区别。
+
 ## 为什么要升级
 
 2025.8.3 本身没坏。但它落后太久，后面的版本里已经累积了一堆 CVE 漏洞修复，
@@ -166,4 +196,17 @@ authentik 现在跑着 **2026.8.1**——最新、已打补丁、所有容器健
 
 值得记住的教训：认证基础设施的大版本升级，大概 10% 是「改镜像 tag」，90% 是
 「数据模型、存储结构、代理规则在你脚下全都挪了位」。做好备份，一次走一个版本，
-当某个东西表现得完全不合理时，伸手去抓下一份配置之前，先把字段名再念一遍。
\ No newline at end of file
+当某个东西表现得完全不合理时，伸手去抓下一份配置之前，先把字段名再念一遍。
+
+---
+
+## 想为你的企业搭一套单点登录？
+
+如果你正在运营好几个内部应用——仪表盘、邮箱服务器、工单系统、文件服务器——而
+你的团队还在一个个分开登录（或者到处重复用同一个密码），我搭设和维护的正是这类
+基础设施。我会帮你部署 authentik、接到你现有的应用上、加上 MFA，确保「登录一次」
+真的能跑通——最后还会给你一份交接文档，让你永远不会被锁死。
+
+联系我：[me@hoelee.com](mailto:me@hoelee.com)，或 WhatsApp
+[+60 12-797 2969](https://wa.me/60127972969)，看看我在
+[hoelee.com](https://hoelee.com) 做的东西。
\ No newline at end of file