diff --git a/manifest/overlays/production/argocd-cmd-params-cm-patch.yaml b/manifest/overlays/production/argocd-cmd-params-cm-patch.yaml
index adb1a66..8002235 100644
--- a/manifest/overlays/production/argocd-cmd-params-cm-patch.yaml
+++ b/manifest/overlays/production/argocd-cmd-params-cm-patch.yaml
@@ -6,5 +6,9 @@ metadata:
 data:
   redis.server: shared-redis.data:6379
   server.insecure: "true"
-  server.disable.auth: "true"
+  # Keep auth ENABLED so Keycloak SSO + local admin login work. (Was set to
+  # "true" in e712652 for the Headlamp argocd plugin, which disabled login for
+  # everyone; the Headlamp plugin reads Application CRDs via the k8s API and
+  # does not need this.)
+  server.disable.auth: "false"
   server.enable.proxy.extension: "true"