diff --git a/packages/apps/tenant/Chart.yaml b/packages/apps/tenant/Chart.yaml
index 476359185..1fa3d3253 100644
--- a/packages/apps/tenant/Chart.yaml
+++ b/packages/apps/tenant/Chart.yaml
@@ -4,3 +4,7 @@ description: Separated tenant namespace
 icon: /logos/tenant.svg
 type: application
 version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
+dependencies:
+  - name: cozy-lib
+    version: "*"
+    repository: "file://charts/cozy-lib"
diff --git a/packages/apps/tenant/templates/keycloakgroups.yaml b/packages/apps/tenant/templates/keycloakgroups.yaml
index 9e25e60d1..f135a64a9 100644
--- a/packages/apps/tenant/templates/keycloakgroups.yaml
+++ b/packages/apps/tenant/templates/keycloakgroups.yaml
@@ -1,4 +1,11 @@
-{{- $oidcEnabled := index .Values._cluster "oidc-enabled" }}
+{{- /* _cluster is injected by the platform, so it is absent whenever the chart
+       is rendered on its own, as `helm lint` and `helm template` do. `index`
+       errors on a nil map before any `| default` on its result can apply, so
+       the guard has to sit on the map rather than on the looked-up value. With
+       _cluster present this yields exactly what indexing it directly yielded;
+       with it absent the lookup is nil and the block below stays unrendered,
+       which is what an unconfigured tenant should produce. */ -}}
+{{- $oidcEnabled := index (.Values._cluster | default dict) "oidc-enabled" }}
 {{- if eq $oidcEnabled "true" }}
 {{- if .Capabilities.APIVersions.Has "v1.edp.epam.com/v1" }}
 apiVersion: v1.edp.epam.com/v1
diff --git a/packages/apps/tenant/tests/keycloakgroups_oidc_test.yaml b/packages/apps/tenant/tests/keycloakgroups_oidc_test.yaml
new file mode 100644
index 000000000..ae07b17b9
--- /dev/null
+++ b/packages/apps/tenant/tests/keycloakgroups_oidc_test.yaml
@@ -0,0 +1,53 @@
+suite: tenant keycloak realm groups — the oidc gate survives an uninjected _cluster
+templates:
+  - templates/keycloakgroups.yaml
+
+# `_cluster` is injected by the platform, so it is simply absent whenever the
+# chart is rendered on its own: `helm lint`, `helm template`, and this suite.
+# The template reads it with `index`, and `index` on a nil map is a hard error
+# rather than an empty result, so before the guard the chart could not be
+# rendered outside a cluster at all.
+#
+# The guard has to sit on the map, not on the value: the spelling used
+# elsewhere in the tree, `(index .Values._cluster "x") | default "y"`, does not
+# help, because `index` is evaluated first and fails before `default` ever sees
+# a result to substitute.
+#
+# The third case below is the one that pins the fix. It carries no `set:` at
+# all, because `_cluster` is absent from values.yaml, so "the platform injected
+# nothing" needs no mocking — it is just the chart's own default state.
+
+release:
+  name: tenant-alice
+  namespace: tenant-alice
+
+capabilities:
+  apiVersions:
+    - v1.edp.epam.com/v1
+
+tests:
+  - it: renders the four realm groups when oidc is enabled
+    set:
+      _cluster:
+        oidc-enabled: "true"
+    asserts:
+      - hasDocuments:
+          count: 4
+
+  - it: renders nothing when oidc is explicitly disabled
+    # The gate is an equality against the string "true", so anything else is
+    # off. Pinned alongside the enabled case so a guard that accidentally
+    # rendered unconditionally would be caught.
+    set:
+      _cluster:
+        oidc-enabled: "false"
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: renders nothing when the platform injected no _cluster at all
+    # Fails with `index of untyped nil` without the guard. This is the case the
+    # fix exists for, and the reason the chart can now be rendered standalone.
+    asserts:
+      - hasDocuments:
+          count: 0