diff --git a/k8s/bases/infrastructure/controllers/dex/helm-release.yaml b/k8s/bases/infrastructure/controllers/dex/helm-release.yaml
index 849ec7f85..e3f2322b7 100644
--- a/k8s/bases/infrastructure/controllers/dex/helm-release.yaml
+++ b/k8s/bases/infrastructure/controllers/dex/helm-release.yaml
@@ -156,3 +156,9 @@ spec:
             useLoginAsID: false
             orgs:
               - name: devantler-tech
+                # Actual Budget authenticates directly against Dex, without
+                # oauth2-proxy's allowed_groups layer. Restrict the shared
+                # GitHub connector to the same maintainer team so native OIDC
+                # apps cannot be accessed by every organization member.
+                teams:
+                  - maintainers