diff --git a/hosts/EDaaS/configuration.nix b/hosts/EDaaS/configuration.nix
index 89da4eb..bcb5ab9 100644
--- a/hosts/EDaaS/configuration.nix
+++ b/hosts/EDaaS/configuration.nix
@@ -62,6 +62,11 @@
 
   features.swayDesktop.enable = false;
 
+  # Opt out of fleet-wide SSSD/Authentik LDAP auth: this is a work-managed WSL
+  # box, not part of the personal directory. Every other NixOS host inherits the
+  # default-true from modules/sssd.nix.
+  services.authentikLdap.enable = false;
+
   # NOTE: this user's systemd --user lingering -- so the home-manager renovate
   # timer fires without an open login session -- is enabled from the host table
   # in flake.nix (users.emmathorpe.linger = true) and applied by