If you’re using SSO make sure to check out this thread.
Summary: Zammad’s SSO implementation has a depency for the libapache2-mod-auth-kerb package which is not available on Debian 11 due to recently discovered security flaws. You’ll have to backport the fixed version from the Debian unstable channel to make SSO work. We tested this in conjunction with an Active Directory domain and can confirm it’s working on our test vm .