diff --git a/.env.sample b/.env.sample
index 3b8ba28..3607baa 100644
--- a/.env.sample
+++ b/.env.sample
@@ -56,3 +56,9 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
 # SECRET_MATRIX_ID_VERSION=v1
 # SECRET_MATRIX_SECRET_VERSION=v1
 # APP_ICONS="$APP_ICONS matrix:~/.abra/recipes/authentik/icons/matrix.svg"
+
+# COMPOSE_FILE="$COMPOSE_FILE:compose.wekan.yml"
+# WEKAN_DOMAIN=wekan.example.com
+# SECRET_WEKAN_ID_VERSION=v1
+# SECRET_WEKAN_SECRET_VERSION=v1
+# APP_ICONS="$APP_ICONS wekan:~/.abra/recipes/authentik/icons/wekan.png"
diff --git a/abra.sh b/abra.sh
index 4d798e0..5a06e57 100644
--- a/abra.sh
+++ b/abra.sh
@@ -8,6 +8,7 @@ export SYSTEM_TENANT_VERSION=v1
 export NEXTCLOUD_CONFIG_VERSION=v1
 export WORDPRESS_CONFIG_VERSION=v1
 export MATRIX_CONFIG_VERSION=v1
+export WEKAN_CONFIG_VERSION=v1
 
 customize() {
     if [ -z "$1" ]
diff --git a/compose.wekan.yml b/compose.wekan.yml
new file mode 100644
index 0000000..49b506e
--- /dev/null
+++ b/compose.wekan.yml
@@ -0,0 +1,26 @@
+version: "3.8"
+services:
+  worker:
+    secrets:
+      - wekan_id
+      - wekan_secret
+    environment:
+      - WEKAN_DOMAIN
+    configs:
+      - source: wekan
+        target: /blueprints/wekan.yaml
+
+secrets:
+  wekan_id:
+    external: true
+    name: ${STACK_NAME}_wekan_id_${SECRET_WEKAN_ID_VERSION}
+  wekan_secret:
+    external: true
+    name: ${STACK_NAME}_wekan_secret_${SECRET_WEKAN_SECRET_VERSION}
+
+
+configs:
+  wekan:
+    name: ${STACK_NAME}_wekan_${WEKAN_CONFIG_VERSION}
+    file: wekan.yaml.tmpl
+    template_driver: golang
diff --git a/icons/wekan.png b/icons/wekan.png
new file mode 100644
index 0000000..b345944
Binary files /dev/null and b/icons/wekan.png differ
diff --git a/wekan.yaml.tmpl b/wekan.yaml.tmpl
new file mode 100644
index 0000000..63dab5f
--- /dev/null
+++ b/wekan.yaml.tmpl
@@ -0,0 +1,43 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: wekan
+
+entries:
+
+- attrs:
+    access_code_validity: minutes=1
+    authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+    client_id: {{ secret  "wekan_id" }}
+    client_secret: {{ secret  "wekan_secret" }}
+    client_type: confidential
+    include_claims_in_id_token: true
+    issuer_mode: per_provider
+    name: Wekan
+    property_mappings:
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
+    - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
+    signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+    sub_mode: user_username
+    token_validity: days=30
+  conditions: []
+  id: wekan_provider
+  identifiers:
+    pk: 9996
+  model: authentik_providers_oauth2.oauth2provider
+  state: present
+
+- attrs:
+    meta_launch_url: https://{{ env  "WEKAN_DOMAIN" }}
+    open_in_new_tab: true
+    policy_engine_mode: any
+    provider: !KeyOf wekan_provider
+    slug: wekan
+  conditions: []
+  id: wekan_application
+  identifiers:
+    name: Wekan
+  model: authentik_core.application
+  state: present