diff --git a/user/authentik/APKBUILD b/user/authentik/APKBUILD
index 8fec332..43e18e9 100644
--- a/user/authentik/APKBUILD
+++ b/user/authentik/APKBUILD
@@ -3,7 +3,7 @@
 
 pkgname=authentik
 pkgver=2023.5.4
-pkgrel=0
+pkgrel=1
 pkgdesc="An open-source Identity Provider focused on flexibility and versatility"
 url="https://github.com/goauthentik/authentik"
 # py3-xmlsec needs some work
@@ -152,6 +152,7 @@ source="
 	authentik-worker.openrc
 	authentik-ldap.openrc
 	authentik-ldap.conf
+	authentik-manage.sh
 	root-settings-csrf_trusted_origins.patch
 	"
 builddir="$srcdir/"authentik-version-$pkgver
@@ -226,6 +227,9 @@ package() {
 	sed -i 's|template_dir.*|template_dir: /var/lib/authentik/templates|' "$pkgdir"/etc/authentik/config.yml
 	printf "\ncsrf:\n  trusted_origins: ['auth.example.com']" >> "$pkgdir"/etc/authentik/config.yml
 	printf "\nsecret_key: '@@SECRET_KEY@@'" >> "$pkgdir"/etc/authentik/config.yml
+
+	# Install wrapper script to /usr/bin.
+	install -m755 -D "$srcdir"/authentik-manage.sh "$pkgdir"/usr/bin/authentik-manage
 }
 
 sha512sums="
@@ -234,5 +238,6 @@ sha512sums="
 5d7f28bf5a9f358a0fc3634b2bac6d070c276c3f8181d26fa7e94a17503a4d54556bf7c3207ccd6cb924b81754ed965795d5e2a8aa1af409fd9e32d390ec4cf5  authentik-worker.openrc
 351e6920d987861f8bf0d7ab2f942db716a8dbdad1f690ac662a6ef29ac0fd46cf817cf557de08f1c024703503d36bc8b46f0d9eb1ecaeb399dce4c3bb527d17  authentik-ldap.openrc
 89ee5f0ffdade1c153f3a56ff75b25a7104aa81d8c7a97802a8f4b0eab34850cee39f874dabe0f3c6da3f71d6a0f938f5e8904169e8cdd34d407c8984adee6b0  authentik-ldap.conf
+d2df285e09d05bb78b17cdbf156cb19883764d0ae61d4c8faed599c015277b75c3f51e5fcb35e01fc25d5847f667ff2089d5e6c48b85a3a6b4523278b2eea89d  authentik-manage.sh
 483befe5e2c90c4f37d5b3ef95ebb99a4208927ee0481e948117a79e36cce110ed53eaa0a9a816cf30ba4c0691b504c9c08d2f9dd7a7bc465a618af260aa1145  root-settings-csrf_trusted_origins.patch
 "
diff --git a/user/authentik/authentik-manage.sh b/user/authentik/authentik-manage.sh
new file mode 100644
index 0000000..43244b0
--- /dev/null
+++ b/user/authentik/authentik-manage.sh
@@ -0,0 +1,12 @@
+
+#!/bin/sh
+
+BUNDLE_DIR='/usr/share/webapps/authentik'
+
+cd $BUNDLE_DIR
+
+if [ "$(id -un)" != 'authentik' ]; then
+	exec su authentik -c '"$0" "$@"' -- ./manage.py "$@"
+else
+	exec ./manage.py "$@"
+fi