From d2a6f1bcf741bcefe236957b4ad31b8a1ca7120b Mon Sep 17 00:00:00 2001
From: Brian Rodriguez <48717031+CervezaStallone@users.noreply.github.com>
Date: Thu, 29 Oct 2026 15:07:29 +0100
Subject: [PATCH] fix(authentik): migrate systemd units when still on
 pre-2026.8 paths (#18307)

The ExecStart migration only ran when ~/.authentik reported a version
below 2026.8. Installs whose marker already reads 2026.8.x but whose
units were never migrated kept pointing to the removed
/opt/authentik/authentik-server binary and failed with 203/EXEC.

Also run the migration when the server unit still has the old path.

Fixes #18306
---
 ct/authentik.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ct/authentik.sh b/ct/authentik.sh
index 21365a33c..ae5c6db8d 100644
--- a/ct/authentik.sh
+++ b/ct/authentik.sh
@@ -155,7 +155,8 @@ function update_script() {
     rm -r /opt/authentik/blueprints
     $STD find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +
 
-    if [[ $MAJOR == 2026 && $MINOR -lt 8 ]]; then
+    # Also catch installs whose version marker already reads 2026.8.x but whose units were never migrated
+    if [[ $MAJOR == 2026 && $MINOR -lt 8 ]] || grep -q "ExecStart=/opt/authentik/authentik-server" /etc/systemd/system/authentik-server.service; then
 	    msg_info "Updating Worker and Server config (from $MAJOR.$MINOR)"
       cat <<EOF >>/etc/default/authentik-server
 RUST_BACKTRACE=full