In 2026.5.*, did Authentik workers change to bind to port 9000?

[danthonywalker]

Hello, I am attempting to upgrade to 2026.5.6. After a few trial and errors I finally got a working instance up. However, my Authentik worker is down. When I check its logs I see this:

Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"src/worker/mod.rs","level":"info","line_number":65,"pid":2,"target":"authentik::worker","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-08-14T12:34:04.206127","event":"starting worker","worker_id":1000}
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"packages/ak-common/src/db.rs","level":"info","line_number":53,"pid":2,"target":"authentik_common::db","thread_id":"ThreadId(4)","thread_name":"tokio-2","timestamp":"2026-08-14T12:34:04.206246","event":"starting database watcher for config changes"}
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"src/worker/mod.rs","level":"info","line_number":286,"pid":2,"target":"authentik::worker","thread_id":"ThreadId(4)","thread_name":"tokio-2","timestamp":"2026-08-14T12:34:04.206322","event":"starting worker watcher"}
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"packages/ak-axum/src/server.rs","level":"info","line_number":77,"pid":2,"target":"authentik_axum::server","thread_id":"ThreadId(4)","thread_name":"tokio-2","timestamp":"2026-08-14T12:34:04.206347","addr":"\"/dev/shm/authentik.sock\" (pathname)","e>
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"packages/ak-axum/src/server.rs","level":"info","line_number":25,"pid":2,"target":"authentik_axum::server","thread_id":"ThreadId(5)","thread_name":"tokio-3","timestamp":"2026-08-14T12:34:04.206357","addr":"[::]:9000","event":"starting worker server>
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"packages/ak-common/src/arbiter.rs","level":"info","line_number":257,"pid":2,"target":"authentik_common::arbiter","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-08-14T12:34:04.206550","event":"arbiter has been told to shutdown gra>
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"packages/ak-common/src/arbiter.rs","level":"info","line_number":270,"pid":2,"target":"authentik_common::arbiter","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-08-14T12:34:04.206575","event":"all webservers have been shutdown, sh>
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"packages/ak-common/src/arbiter.rs","level":"info","line_number":239,"pid":2,"target":"authentik_common::arbiter","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-08-14T12:34:04.206583","event":"arbiter has been told to shutdown imm>
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"packages/ak-common/src/arbiter.rs","level":"info","line_number":250,"pid":2,"target":"authentik_common::arbiter","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-08-14T12:34:04.206595","event":"all webservers have been shutdown, sh>
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"src/worker/mod.rs","level":"info","line_number":109,"pid":2,"target":"authentik::worker","thread_id":"ThreadId(5)","thread_name":"tokio-3","timestamp":"2026-08-14T12:34:04.206735","event":"immediately shutting down worker"}
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"packages/ak-common/src/arbiter.rs","level":"info","line_number":80,"pid":2,"target":"authentik_common::arbiter","thread_id":"ThreadId(5)","thread_name":"tokio-3","timestamp":"2026-08-14T12:34:04.206750","event":"stopping signals watcher"}
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"packages/ak-common/src/config/mod.rs","level":"info","line_number":265,"pid":2,"target":"authentik_common::config","thread_id":"ThreadId(2)","thread_name":"tokio-0","timestamp":"2026-08-14T12:34:04.206754","event":"stopping config file watcher"}
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"packages/ak-common/src/db.rs","level":"info","line_number":62,"pid":2,"target":"authentik_common::db","thread_id":"ThreadId(5)","thread_name":"tokio-3","timestamp":"2026-08-14T12:34:04.206762","event":"stopping database watcher for config changes"}
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: {"filename":"src/main.rs","level":"error","line_number":121,"pid":2,"target":"authentik","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-08-14T12:34:04.206938","err":"[\n   0: \u001b[91mAddress already in use (os error 98)\u001b[0m\n\nLocation>
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: Error: 
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:    0: Errors encountered: [
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:          0: Address already in use (os error 98)
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: 
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:       Location:
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:          packages/ak-axum/src/server.rs:30
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: 
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:         ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ SPANTRACE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: 
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:          0: tokio::task::runtime.spawn with kind=task task.name=authentik_axum::server::run_plain(worker, [::]:9000) task.id=18 size.bytes=1664 loc.file="packages/ak-axum/src/server.rs" loc.line=56 loc.col=10
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:             at /root/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.52.3/src/util/trace.rs:69
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: 
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:       Backtrace omitted. Run with RUST_BACKTRACE=1 environment variable to display it.
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:       Run with RUST_BACKTRACE=full to include source snippets.]
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: 
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: Location:
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:    src/main.rs:122
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: 
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ SPANTRACE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: 
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:    0: tokio::task::runtime.spawn with kind=block_on task.name= task.id=5 size.bytes=2824 loc.file="src/main.rs" loc.line=83 loc.col=10
Aug 14 12:34:04 vm-authentik authentik-worker[1810]:       at /root/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.52.3/src/util/trace.rs:69
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: 
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: Backtrace omitted. Run with RUST_BACKTRACE=1 environment variable to display it.
Aug 14 12:34:04 vm-authentik authentik-worker[1810]: Run with RUST_BACKTRACE=full to include source snippets.
Aug 14 12:34:04 vm-authentik podman[1830]: 2026-08-14 12:34:04.271787798 +0000 UTC m=+0.022091861 container died 89e0170fac75da6a75fa958bb75c2bf39d3b3bc9d6f4d67d537cf3cf0847b576 (image=ghcr.io/goauthentik/server@sha256:ed120caf710ccf82ef0026f0bc74e51615bc95ebff228a7a2d6fc60c441c3868, name=authentik-worker, org.o>
Aug 14 12:34:04 vm-authentik podman[1830]: 2026-08-14 12:34:04.518903797 +0000 UTC m=+0.269207854 container remove 89e0170fac75da6a75fa958bb75c2bf39d3b3bc9d6f4d67d537cf3cf0847b576 (image=ghcr.io/goauthentik/server@sha256:ed120caf710ccf82ef0026f0bc74e51615bc95ebff228a7a2d6fc60c441c3868, name=authentik-worker, pod>
Aug 14 12:34:04 vm-authentik systemd[714]: authentik-worker.service: Main process exited, code=exited, status=1/FAILURE
Aug 14 12:34:04 vm-authentik systemd[714]: authentik-worker.service: Failed with result 'exit-code'.

Note I am using Podman pods to have my authentik instances under the same pod, so they share the same "localhost" network space. These logs indicate to me the worker is trying to bind to port 9000 which is already in use by the server. This previously was not an issue...did something change? And how could I fix this? I presume I need to set a AUTHENTIK_LISTEN__HTTP env variable (and I imagine AUTHENTIK_LISTEN__HTTPS will also be required).

[danthonywalker]

I have changed AUTHENTIK_LISTEN__HTTP and AUTHENTIK_LISTEN__HTTPS to the worker and it all appears to work.
I know the default LISTENs changed, but I was not expecting the worker to start listening on its own ports. I feel that should be documented as a breaking change.

[dewi-tik]

This is the correct solution.

In 2026.5, the worker now opens its own HTTP and metrics ports, which causes a conflict when it shares the same IP and port space as the server. As a workaround, give the worker different HTTP and metrics ports or run it separately from the server.

We'll add a note about this to our docs.