diff --git a/platform/keycloak/keycloak-realm-import.yaml b/platform/keycloak/keycloak-realm-import.yaml
index 2080a70..110f6b1 100644
--- a/platform/keycloak/keycloak-realm-import.yaml
+++ b/platform/keycloak/keycloak-realm-import.yaml
@@ -423,6 +423,11 @@ spec:
     authenticatorConfig:
       - alias: conditional-otp-platform-admin
         config:
-          "condition.evaluated.user.role": platform-admin
+          # Keycloak's conditional-user-role authenticator reads the role from `condUserRole`
+          # (ConditionalUserRoleAuthenticatorFactory.CONDITIONAL_USER_ROLE). The prior key
+          # "condition.evaluated.user.role" is not a real property, so the role resolved to null →
+          # "Invalid role name submitted: null" → the REQUIRED conditional-OTP step threw and blocked
+          # every platform-admins login (e.g. Headlamp) with a 403. Value is the realm role name.
+          condUserRole: platform-admin
           negate: "false"
     browserFlow: browser-mfa