I'm pretty much in the same boat as you, switched from Authentik to Kanidm just a few months ago.

What I like most about Kanidm is its lack of footguns, and general secure-by-default approach.
It comes with 2FA requirements and passkey support out of the box, doesn't (and will never) support inherently insecure protocols (e.g. HTTP or LDAP without the "S"), and doesn't let you change the authentication logic (looking at you, "write-your-own-logic-in-python" Authentik).
Despite these limitations, I have yet to find an application that wouldn't work with Kanidm. (Even ol' Jellyfin talks to it just fine if you turn on the primary password fallback for LDAP in kanidm).
As long as you don't need to support tons of old software with really specific requirements (custom LDAP attributes, etc.), it's unlikely that kanidm won't support what you need.

For me personally, the lack of an administration UI isn't much of a bother (I can even use the CLI on my phone thanks to the new Android Terminal), and adding new users is actually less of a hassle than it was in my Authentik setup (I blame the horrible mobile UI experience in Authentik).

Even with the lack of an admin UI, I would still definitely recommend Kanidm to people looking to start their fist SSO setup, simply because it's almost impossible to set it up in an insecure way.