diff --git a/charts/sus/assets/README.md b/charts/sus/assets/README.md
new file mode 100644
index 0000000..e584399
--- /dev/null
+++ b/charts/sus/assets/README.md
@@ -0,0 +1,6 @@
+# Bundled portal assets
+
+- `logo.png` — "face with raised eyebrow" (U+1F928), from the
+  [Noto Emoji](https://github.com/googlefonts/noto-emoji) project, licensed
+  Apache-2.0. Used as the default Authelia login-portal logo. Operators can
+  override it via `auth.authelia.branding.logoPngBase64`.
diff --git a/charts/sus/assets/logo.png b/charts/sus/assets/logo.png
new file mode 100644
index 0000000..4d62396
Binary files /dev/null and b/charts/sus/assets/logo.png differ
diff --git a/charts/sus/templates/authelia/assets-configmap.yaml b/charts/sus/templates/authelia/assets-configmap.yaml
new file mode 100644
index 0000000..f9dee43
--- /dev/null
+++ b/charts/sus/templates/authelia/assets-configmap.yaml
@@ -0,0 +1,14 @@
+{{- if and .Values.auth.enabled .Values.auth.authelia.branding.enabled }}
+# Authelia server-asset override mounted at server.asset_path (/config/assets):
+#   logo.png -> the login-portal logo (replaces Authelia's default icon)
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "sus.authelia.fullname" . }}-assets
+  namespace: {{ .Values.namespaces.platform }}
+  labels:
+    {{- include "sus.labels" . | nindent 4 }}
+    app.kubernetes.io/component: authelia
+binaryData:
+  logo.png: {{ .Values.auth.authelia.branding.logoPngBase64 | default (.Files.Get "assets/logo.png" | b64enc) }}
+{{- end }}
diff --git a/charts/sus/templates/authelia/configmap.yaml b/charts/sus/templates/authelia/configmap.yaml
index 71e015e..d5cbaf4 100644
--- a/charts/sus/templates/authelia/configmap.yaml
+++ b/charts/sus/templates/authelia/configmap.yaml
@@ -12,9 +12,13 @@ metadata:
     app.kubernetes.io/component: authelia
 data:
   configuration.yml: |
-    theme: light
+    theme: {{ .Values.auth.authelia.branding.theme | default "light" }}
     server:
       address: 'tcp://:9091'
+      {{- if .Values.auth.authelia.branding.enabled }}
+      # Override the portal logo/favicon and text (see the -assets ConfigMap).
+      asset_path: /config/assets
+      {{- end }}
     log:
       level: info
     totp:
diff --git a/charts/sus/templates/authelia/deployment.yaml b/charts/sus/templates/authelia/deployment.yaml
index 828f66e..0be6d73 100644
--- a/charts/sus/templates/authelia/deployment.yaml
+++ b/charts/sus/templates/authelia/deployment.yaml
@@ -27,6 +27,9 @@ spec:
         # used — rotate/roll that yourself.)
         checksum/authelia-config: {{ include (print $.Template.BasePath "/authelia/configmap.yaml") . | sha256sum }}
         checksum/authelia-secret: {{ include (print $.Template.BasePath "/authelia/secret.yaml") . | sha256sum }}
+        {{- if .Values.auth.authelia.branding.enabled }}
+        checksum/authelia-assets: {{ include (print $.Template.BasePath "/authelia/assets-configmap.yaml") . | sha256sum }}
+        {{- end }}
     spec:
       containers:
         - name: authelia
@@ -76,10 +79,23 @@ spec:
               readOnly: true
             - name: data
               mountPath: /data
+            {{- if .Values.auth.authelia.branding.enabled }}
+            # subPath mount places the logo into the asset tree
+            # (server.asset_path = /config/assets) without shadowing the rest of it.
+            - name: assets
+              mountPath: /config/assets/logo.png
+              subPath: logo.png
+              readOnly: true
+            {{- end }}
       volumes:
         - name: config
           configMap:
             name: {{ include "sus.authelia.fullname" . }}
+        {{- if .Values.auth.authelia.branding.enabled }}
+        - name: assets
+          configMap:
+            name: {{ include "sus.authelia.fullname" . }}-assets
+        {{- end }}
         - name: users
           secret:
             secretName: {{ $secretName }}
diff --git a/charts/sus/values.yaml b/charts/sus/values.yaml
index bb567b1..90841c6 100644
--- a/charts/sus/values.yaml
+++ b/charts/sus/values.yaml
@@ -111,6 +111,16 @@ auth:
       # Pinned minor tag — Authelia's config schema is version-sensitive.
       tag: "4.38"
       pullPolicy: IfNotPresent
+    # -- Login-portal branding. Replaces Authelia's default icon with the SUS 🤨
+    # logo by default; the rest of the portal (including the "Sign in" text) is
+    # left as Authelia ships it.
+    branding:
+      enabled: true
+      # Portal color scheme: light | dark | grey | auto.
+      theme: light
+      # -- Override the bundled 🤨 logo with your own PNG (base64-encoded, e.g.
+      # `base64 -i logo.png`). Empty = use the bundled SUS logo.
+      logoPngBase64: ""
     # Memory limit must accommodate argon2id password verification, which is
     # memory-hard by design (default parameters use 64MiB per concurrent login)
     # on top of Authelia's baseline — too low a limit OOM-kills the container