diff --git a/authentik/root/settings.py b/authentik/root/settings.py
index 1567b44be..117a4285c 100644
--- a/authentik/root/settings.py
+++ b/authentik/root/settings.py
@@ -67,7 +67,6 @@ SHARED_APPS = [
 TENANT_APPS = [
     "django.contrib.auth",
     "django.contrib.sessions",
-    "authentik.tenants",
     "authentik.admin",
     "authentik.api",
     "authentik.crypto",
diff --git a/authentik/tenants/apps.py b/authentik/tenants/apps.py
index 409cfa654..2e21f5208 100644
--- a/authentik/tenants/apps.py
+++ b/authentik/tenants/apps.py
@@ -1,10 +1,28 @@
 """authentik tenants app"""
-from django.apps import AppConfig
+from django.db import DEFAULT_DB_ALIAS
+from django.db.models.signals import post_migrate
+
+from authentik.blueprints.apps import ManagedAppConfig
 
 
-class AuthentikTenantsConfig(AppConfig):
+def reconcile_default_tenant(using=DEFAULT_DB_ALIAS, *args, **kwargs):
+    """Make sure default tenant exists"""
+    from authentik.tenants.models import Tenant
+
+    Tenant.objects.using(using).update_or_create(
+        defaults={"name": "Default", "ready": True},
+        schema_name="public",
+    )
+
+
+class AuthentikTenantsConfig(ManagedAppConfig):
     """authentik tenants app"""
 
     name = "authentik.tenants"
     label = "authentik_tenants"
     verbose_name = "authentik Tenants"
+    default = True
+
+    def reconcile_default_tenant(self):
+        reconcile_default_tenant()
+        post_migrate.connect(reconcile_default_tenant)
diff --git a/authentik/tenants/models.py b/authentik/tenants/models.py
index fa6358ce5..f727127c1 100644
--- a/authentik/tenants/models.py
+++ b/authentik/tenants/models.py
@@ -86,6 +86,10 @@ class Tenant(TenantMixin, SerializerModel):
 class Domain(DomainMixin, SerializerModel):
     """Tenant domain"""
 
+    tenant = models.ForeignKey(
+        Tenant, db_index=True, related_name="domains", on_delete=models.CASCADE
+    )
+
     def __str__(self) -> str:
         return f"Domain {self.domain}"