I synced immich to authentik post deployment no issue, but I believe my email matched. I don’t recall if I had to configure my user account ontop of the oauth settings or not, I believe it was smart enough to link the same email to the account.

If you are using a VM style deployment you could run a snapshot of the immich server ahead of time then just rollback if it fails. That’s what I do for all services when changing stuff.