diff --git a/compose.yaml b/compose.yaml
index 1bf75f785..deb7fb16d 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -21,6 +21,9 @@ services:
         VUE_APP_POSTHOG_API_KEY: ${VUE_APP_POSTHOG_API_KEY:-}
         VUE_APP_GOOGLE_CLIENT_ID: ${CLIENT_ID:-}
         VUE_APP_MICROSOFT_CLIENT_ID: ${MICROSOFT_CLIENT_ID:-}
+        VUE_APP_OIDC_PROVIDER_NAME: ${OIDC_PROVIDER_NAME:-}
+        VUE_APP_OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
+        VUE_APP_OIDC_AUTHORIZATION_ENDPOINT: ${OIDC_ISSUER_URL:-}/authorize
     volumes:
       - frontend_dist:/app/dist
     command:
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index c03ed002c..9faae00bd 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -16,10 +16,16 @@ COPY . .
 ARG VUE_APP_POSTHOG_API_KEY=""
 ARG VUE_APP_GOOGLE_CLIENT_ID=""
 ARG VUE_APP_MICROSOFT_CLIENT_ID=""
+ARG VUE_APP_OIDC_CLIENT_ID=""
+ARG VUE_APP_OIDC_AUTHORIZATION_ENDPOINT=""
+ARG VUE_APP_OIDC_PROVIDER_NAME=""
 
 ENV VUE_APP_POSTHOG_API_KEY=$VUE_APP_POSTHOG_API_KEY
 ENV VUE_APP_GOOGLE_CLIENT_ID=$VUE_APP_GOOGLE_CLIENT_ID
 ENV VUE_APP_MICROSOFT_CLIENT_ID=$VUE_APP_MICROSOFT_CLIENT_ID
+ENV VUE_APP_OIDC_CLIENT_ID=$VUE_APP_OIDC_CLIENT_ID
+ENV VUE_APP_OIDC_AUTHORIZATION_ENDPOINT=$VUE_APP_OIDC_AUTHORIZATION_ENDPOINT
+ENV VUE_APP_OIDC_PROVIDER_NAME=$VUE_APP_OIDC_PROVIDER_NAME
 
 # Build the app and move to /build so it's not hidden by volume mount
 RUN npm run build && mv dist /build
diff --git a/frontend/src/App.vue b/frontend/src/App.vue
index 176178b5c..91e751372 100644
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@@ -236,6 +236,7 @@ import {
   isPhone,
   post,
   signInGoogle,
+  signInOidc,
   signInOutlook,
   isPremiumUser,
 } from "@/utils"
@@ -391,6 +392,10 @@ export default {
             state,
             selectAccount: true,
           })
+        } else if (calendarType === calendarTypes.OIDC) {
+          signInOidc({
+            state,
+          })
         }
       }
     },
diff --git a/frontend/src/components/SignInDialog.vue b/frontend/src/components/SignInDialog.vue
index 8077809c2..68f0084f0 100644
--- a/frontend/src/components/SignInDialog.vue
+++ b/frontend/src/components/SignInDialog.vue
@@ -45,6 +45,21 @@
                 <v-spacer />
               </div>
             </v-btn>
+            <v-btn
+              v-if="oidcEnabled"
+              block
+              @click="signIn(calendarTypes.OIDC)"
+              class="tw-bg-white"
+            >
+              <div class="tw-flex tw-w-full tw-items-center tw-gap-2">
+                <v-icon class="tw-flex-initial" size="20"
+                  >mdi-shield-account-outline</v-icon
+                >
+                <v-spacer />
+                Continue with {{ oidcProviderName }}
+                <v-spacer />
+              </div>
+            </v-btn>
 
             <div class="tw-my-2 tw-flex tw-items-center tw-gap-3">
               <v-divider />
@@ -206,6 +221,17 @@ export default {
   props: {
     value: { type: Boolean, required: true },
   },
+  computed: {
+    oidcEnabled() {
+      return !!(
+        process.env.VUE_APP_OIDC_CLIENT_ID &&
+        process.env.VUE_APP_OIDC_AUTHORIZATION_ENDPOINT
+      )
+    },
+    oidcProviderName() {
+      return process.env.VUE_APP_OIDC_PROVIDER_NAME || "SSO"
+    },
+  },
   data() {
     return {
       calendarTypes,
diff --git a/frontend/src/constants.js b/frontend/src/constants.js
index 216d11595..52891ba9b 100644
--- a/frontend/src/constants.js
+++ b/frontend/src/constants.js
@@ -48,7 +48,8 @@ export const calendarTypes = Object.freeze({
   GOOGLE: "google",
   APPLE: "apple",
   OUTLOOK: "outlook",
-  ICS: "ics"
+  ICS: "ics",
+  OIDC: "oidc",
 })
 
 export const upgradeDialogTypes = Object.freeze({
@@ -183,4 +184,4 @@ export const guestUserId = "000000000000000000000000"
 
 export const numFreeEvents = 3
 
-export const urlRegex = /https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)/
\ No newline at end of file
+export const urlRegex = /https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)/
diff --git a/frontend/src/utils/sign_in_utils.js b/frontend/src/utils/sign_in_utils.js
index 6f150bfe1..ce4916195 100644
--- a/frontend/src/utils/sign_in_utils.js
+++ b/frontend/src/utils/sign_in_utils.js
@@ -69,3 +69,30 @@ export const signInOutlook = ({
   const url = `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=${clientId}&response_type=code&redirect_uri=${redirectUri}&response_mode=query&scope=${scope}${stateString}`
   window.location.href = url
 }
+
+/**
+ * Redirects the user to the configured OIDC provider's authorization
+ * endpoint to sign in / create an account. This is authentication-only.
+ *
+ * Requires VUE_APP_OIDC_CLIENT_ID and VUE_APP_OIDC_AUTHORIZATION_ENDPOINT to
+ * be set at frontend build time.
+ */
+export const signInOidc = ({ state = {} } = {}) => {
+  const clientId = process.env.VUE_APP_OIDC_CLIENT_ID
+  const authorizationEndpoint = process.env.VUE_APP_OIDC_AUTHORIZATION_ENDPOINT
+  const redirectUri = encodeURIComponent(`${window.location.origin}/auth`)
+
+  // We put scope on `state` because not every OIDC provider echoes `scope`
+  // back on the callback. Auth.vue reads `scope ?? state.scope`.
+  const scope = "openid email profile"
+
+  if (!state) state = {}
+  state.calendarType = calendarTypes.OIDC
+  state.scope = scope
+  const stateString = `&state=${encodeURIComponent(JSON.stringify(state))}`
+
+  const url = `${authorizationEndpoint}?client_id=${clientId}&redirect_uri=${redirectUri}&response_type=code&scope=${encodeURIComponent(
+    scope,
+  )}${stateString}`
+  window.location.href = url
+}
diff --git a/frontend/src/views/SignIn.vue b/frontend/src/views/SignIn.vue
index 6366f72ca..fe11e0957 100644
--- a/frontend/src/views/SignIn.vue
+++ b/frontend/src/views/SignIn.vue
@@ -66,6 +66,22 @@
                   <v-spacer />
                 </div>
               </v-btn>
+              <v-btn
+                v-if="oidcEnabled"
+                block
+                @click="signIn(calendarTypes.OIDC)"
+                class="tw-bg-white"
+              >
+                <div class="tw-flex tw-w-full tw-items-center tw-gap-2">
+                  <v-icon class="tw-flex-initial" size="20"
+                    >mdi-shield-account-outline</v-icon
+                  >
+                  <v-spacer />
+                  {{ isSignUp ? "Sign up with" : "Continue with" }}
+                  {{ oidcProviderName }}
+                  <v-spacer />
+                </div>
+              </v-btn>
 
               <div class="tw-my-2 tw-flex tw-items-center tw-gap-3">
                 <v-divider />
@@ -251,7 +267,7 @@
 
 <script>
 import { authTypes, calendarTypes } from "@/constants"
-import { post, signInGoogle, signInOutlook } from "@/utils"
+import { post, signInGoogle, signInOutlook, signInOidc } from "@/utils"
 import { mapMutations } from "vuex"
 import Logo from "@/components/Logo.vue"
 
@@ -276,6 +292,17 @@ export default {
     upgradeRedirect() {
       return this.$route.query.redirect === "upgrade"
     },
+    // Only show the OIDC button if the frontend was built with an OIDC
+    // client id/authorization endpoint configured
+    oidcEnabled() {
+      return !!(
+        process.env.VUE_APP_OIDC_CLIENT_ID &&
+        process.env.VUE_APP_OIDC_AUTHORIZATION_ENDPOINT
+      )
+    },
+    oidcProviderName() {
+      return process.env.VUE_APP_OIDC_PROVIDER_NAME || "SSO"
+    },
   },
 
   data() {
@@ -307,6 +334,8 @@ export default {
         signInGoogle({ state, selectAccount: true })
       } else if (provider === calendarTypes.OUTLOOK) {
         signInOutlook({ state, selectAccount: true })
+      } else if (provider === calendarTypes.OIDC) {
+        signInOidc({ state })
       }
     },
     validateEmail() {
diff --git a/server/.env.template b/server/.env.template
index 84618e524..45013bba8 100644
--- a/server/.env.template
+++ b/server/.env.template
@@ -55,4 +55,10 @@ SESSION_SECRET=?
 # CORS
 # - Comma-separated list of allowed origins
 # - For local development, set to: http://localhost:8080
-CORS_ORIGINS=?
\ No newline at end of file
+CORS_ORIGINS=?
+
+# Custom OIDC provider for login, optional
+OIDC_PROVIDER_NAME=
+OIDC_CLIENT_ID=
+OIDC_ISSUER_URL=
+OIDC_CLIENT_SECRET=
diff --git a/server/models/calendar.go b/server/models/calendar.go
index 3ce35efe6..f1b9f702e 100644
--- a/server/models/calendar.go
+++ b/server/models/calendar.go
@@ -12,6 +12,7 @@ const (
 	GoogleCalendarType  CalendarType = "google"
 	OutlookCalendarType CalendarType = "outlook"
 	ICSCalendarType     CalendarType = "ics"
+	OidcCalendarType    CalendarType = "oidc"
 )
 
 // OAuth2CalendarAuth contains necessary auth info for the user's google calendar account
diff --git a/server/routes/auth.go b/server/routes/auth.go
index a894a1bb3..c72cf0a1f 100644
--- a/server/routes/auth.go
+++ b/server/routes/auth.go
@@ -128,10 +128,14 @@ func signInMobile(c *gin.Context) {
 
 // Helper function to sign user in with the given parameters from the google oauth route
 func signInHelper(c *gin.Context, token auth.TokenResponse, tokenOrigin models.TokenOriginType, calendarType models.CalendarType, timezoneOffset int) (models.User, error) {
+	// OIDC is authentication-only: we don't get calendar access from it, so all of the CalendarAccounts/subcalendar bookkeeping
+	// below is skipped for it.
+	isOidc := calendarType == models.OidcCalendarType
+
 	// Get access token expire time
 	accessTokenExpireDate := utils.GetAccessTokenExpireDate(token.ExpiresIn)
 
-	// Construct calendar auth object
+	// Construct calendar auth object (unused for OIDC)
 	calendarAuth := models.OAuth2CalendarAuth{
 		AccessToken:           token.AccessToken,
 		AccessTokenExpireDate: primitive.NewDateTimeFromTime(accessTokenExpireDate),
@@ -168,6 +172,28 @@ func signInHelper(c *gin.Context, token auth.TokenResponse, tokenOrigin models.T
 		firstName = userInfo.FirstName
 		lastName = userInfo.LastName
 		picture = ""
+	} else if isOidc {
+		// Verify the ID token returned by the OIDC provider.
+		// As with Google above, we never trust claims from a token we
+		// haven't verified ourselves, before using any of its claims.
+		claims, err := auth.VerifyOidcIdToken(token.IdToken)
+		if err != nil {
+			logger.StdErr.Printf("Failed to verify OIDC ID token: %v", err)
+			return models.User{}, err
+		}
+		email = claims.Email
+		firstName = claims.GivenName
+		lastName = claims.FamilyName
+		if firstName == "" && claims.Name != "" {
+			// Fall back to splitting the "name" claim if the provider didn't
+			// send given_name/family_name
+			parts := strings.SplitN(claims.Name, " ", 2)
+			firstName = parts[0]
+			if len(parts) > 1 {
+				lastName = parts[1]
+			}
+		}
+		picture = claims.Picture
 	}
 	email = utils.NormalizeEmail(email)
 
@@ -186,29 +212,34 @@ func signInHelper(c *gin.Context, token auth.TokenResponse, tokenOrigin models.T
 		TokenOrigin:    tokenOrigin,
 	}
 
-	calendarAccount := models.CalendarAccount{
-		CalendarType:       calendarType,
-		OAuth2CalendarAuth: &calendarAuth,
-
-		Email:   email,
-		Picture: picture,
-		Enabled: utils.TruePtr(), // Workaround to pass a boolean pointer
-	}
+	var calendarAccount models.CalendarAccount
 	canonicalKey := utils.GetCalendarAccountKey(email, calendarType)
+	if !isOidc {
+		calendarAccount = models.CalendarAccount{
+			CalendarType:       calendarType,
+			OAuth2CalendarAuth: &calendarAuth,
+
+			Email:   email,
+			Picture: picture,
+			Enabled: utils.TruePtr(), // Workaround to pass a boolean pointer
+		}
+	}
 
 	var userId primitive.ObjectID
 	existing := db.GetUserByEmail(email)
 	// If user doesn't exist, create a new user
 	if existing == nil {
-		// Fetch subcalendars
-		subCalendars, err := calendar.GetCalendarProvider(calendarAccount).GetCalendarList()
-		if err == nil {
-			calendarAccount.SubCalendars = &subCalendars
-		}
+		if !isOidc {
+			// Fetch subcalendars
+			subCalendars, err := calendar.GetCalendarProvider(calendarAccount).GetCalendarList()
+			if err == nil {
+				calendarAccount.SubCalendars = &subCalendars
+			}
 
-		// Set calendar accounts
-		userData.CalendarAccounts = map[string]models.CalendarAccount{
-			canonicalKey: calendarAccount,
+			// Set calendar accounts
+			userData.CalendarAccounts = map[string]models.CalendarAccount{
+				canonicalKey: calendarAccount,
+			}
 		}
 
 		// Create user
@@ -230,43 +261,49 @@ func signInHelper(c *gin.Context, token auth.TokenResponse, tokenOrigin models.T
 			userData.LastName = ""
 		}
 
-		legacyKey := utils.ActualCalendarAccountMapKey(user, email, calendarType)
+		if isOidc {
+			// OIDC is authentication-only - leave any existing calendar
+			// accounts untouched, just refresh profile info below.
+			userData.CalendarAccounts = user.CalendarAccounts
+		} else {
+			legacyKey := utils.ActualCalendarAccountMapKey(user, email, calendarType)
+
+			var oldSubCalendars *map[string]models.SubCalendar
+			if legacyKey != "" {
+				if oldAcc, ok := user.CalendarAccounts[legacyKey]; ok && oldAcc.SubCalendars != nil {
+					oldSubCalendars = oldAcc.SubCalendars
+				}
+			} else if user.CalendarAccounts != nil {
+				if existingAcc, ok := user.CalendarAccounts[canonicalKey]; ok && existingAcc.SubCalendars != nil {
+					oldSubCalendars = existingAcc.SubCalendars
+				}
+			}
 
-		var oldSubCalendars *map[string]models.SubCalendar
-		if legacyKey != "" {
-			if oldAcc, ok := user.CalendarAccounts[legacyKey]; ok && oldAcc.SubCalendars != nil {
-				oldSubCalendars = oldAcc.SubCalendars
+			var calAccounts map[string]models.CalendarAccount
+			if user.CalendarAccounts == nil {
+				calAccounts = make(map[string]models.CalendarAccount)
+			} else {
+				calAccounts = make(map[string]models.CalendarAccount, len(user.CalendarAccounts))
+				for k, v := range user.CalendarAccounts {
+					calAccounts[k] = v
+				}
 			}
-		} else if user.CalendarAccounts != nil {
-			if existingAcc, ok := user.CalendarAccounts[canonicalKey]; ok && existingAcc.SubCalendars != nil {
-				oldSubCalendars = existingAcc.SubCalendars
+			if legacyKey != "" && legacyKey != canonicalKey {
+				delete(calAccounts, legacyKey)
 			}
-		}
 
-		var calAccounts map[string]models.CalendarAccount
-		if user.CalendarAccounts == nil {
-			calAccounts = make(map[string]models.CalendarAccount)
-		} else {
-			calAccounts = make(map[string]models.CalendarAccount, len(user.CalendarAccounts))
-			for k, v := range user.CalendarAccounts {
-				calAccounts[k] = v
+			if oldSubCalendars != nil {
+				calendarAccount.SubCalendars = oldSubCalendars
+			} else {
+				subCalendars, err := calendar.GetCalendarProvider(calendarAccount).GetCalendarList()
+				if err == nil {
+					calendarAccount.SubCalendars = &subCalendars
+				}
 			}
-		}
-		if legacyKey != "" && legacyKey != canonicalKey {
-			delete(calAccounts, legacyKey)
-		}
 
-		if oldSubCalendars != nil {
-			calendarAccount.SubCalendars = oldSubCalendars
-		} else {
-			subCalendars, err := calendar.GetCalendarProvider(calendarAccount).GetCalendarList()
-			if err == nil {
-				calendarAccount.SubCalendars = &subCalendars
-			}
+			calAccounts[canonicalKey] = calendarAccount
+			userData.CalendarAccounts = calAccounts
 		}
-
-		calAccounts[canonicalKey] = calendarAccount
-		userData.CalendarAccounts = calAccounts
 		userData.Email = email
 
 		// Update user if exists
diff --git a/server/services/auth/auth.go b/server/services/auth/auth.go
index 7e138d334..387d4748c 100644
--- a/server/services/auth/auth.go
+++ b/server/services/auth/auth.go
@@ -246,6 +246,8 @@ func getCredentialsFromCalendarType(calendarType models.CalendarType) (string, s
 		return os.Getenv("CLIENT_ID"), os.Getenv("CLIENT_SECRET")
 	} else if calendarType == models.OutlookCalendarType {
 		return os.Getenv("MICROSOFT_CLIENT_ID"), os.Getenv("MICROSOFT_CLIENT_SECRET")
+	} else if calendarType == models.OidcCalendarType {
+		return os.Getenv("OIDC_CLIENT_ID"), os.Getenv("OIDC_CLIENT_SECRET")
 	}
 
 	return "", ""
@@ -256,6 +258,13 @@ func getTokenEndpointFromCalendarType(calendarType models.CalendarType) string {
 		return "https://oauth2.googleapis.com/token"
 	} else if calendarType == models.OutlookCalendarType {
 		return "https://login.microsoftonline.com/common/oauth2/v2.0/token"
+	} else if calendarType == models.OidcCalendarType {
+		// Discovered from {OIDC_ISSUER_URL}/.well-known/openid-configuration
+		endpoint := GetOidcTokenEndpoint()
+		if endpoint == "" {
+			logger.StdErr.Println("Failed to resolve OIDC token endpoint; is OIDC_ISSUER_URL configured and reachable?")
+		}
+		return endpoint
 	}
 
 	return ""
diff --git a/server/services/auth/oidc.go b/server/services/auth/oidc.go
new file mode 100644
index 000000000..0b0b275fd
--- /dev/null
+++ b/server/services/auth/oidc.go
@@ -0,0 +1,345 @@
+package auth
+
+import (
+	"crypto"
+	"crypto/rsa"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"math/big"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"time"
+)
+
+// This file implements generic OpenID Connect (OIDC) support so users can
+// sign in / create an account via any configured OIDC provider, env vars:
+//
+//   OIDC_ISSUER_URL     - e.g. https://id.example.com
+//   OIDC_CLIENT_ID
+//   OIDC_CLIENT_SECRET
+
+// OidcDiscoveryDocument mirrors the subset of an OIDC discovery document
+// (OpenID Connect Discovery 1.0, served at
+// {issuer}/.well-known/openid-configuration) that we need to drive the
+// authorization-code flow and verify ID tokens.
+type OidcDiscoveryDocument struct {
+	Issuer                string `json:"issuer"`
+	AuthorizationEndpoint string `json:"authorization_endpoint"`
+	TokenEndpoint         string `json:"token_endpoint"`
+	UserinfoEndpoint      string `json:"userinfo_endpoint"`
+	JwksUri               string `json:"jwks_uri"`
+}
+
+type oidcJwk struct {
+	Kty string `json:"kty"`
+	Kid string `json:"kid"`
+	N   string `json:"n"`
+	E   string `json:"e"`
+}
+
+type oidcJwkSet struct {
+	Keys []oidcJwk `json:"keys"`
+}
+
+var (
+	oidcDiscoveryOnce sync.Once
+	oidcDiscovery     OidcDiscoveryDocument
+	oidcDiscoveryErr  error
+
+	oidcJwksMu      sync.RWMutex
+	oidcJwksCache   oidcJwkSet
+	oidcJwksFetched time.Time
+)
+
+// oidcJwksTTL controls how often we refetch the provider's signing keys.
+const oidcJwksTTL = 10 * time.Minute
+
+// getOidcDiscoveryDocument fetches and caches the OIDC provider's discovery
+// document for the lifetime of the process.
+func getOidcDiscoveryDocument() (OidcDiscoveryDocument, error) {
+	oidcDiscoveryOnce.Do(func() {
+		issuer := strings.TrimRight(os.Getenv("OIDC_ISSUER_URL"), "/")
+		if issuer == "" {
+			oidcDiscoveryErr = errors.New("OIDC_ISSUER_URL is not configured")
+			return
+		}
+
+		resp, err := http.Get(issuer + "/.well-known/openid-configuration")
+		if err != nil {
+			oidcDiscoveryErr = fmt.Errorf("failed to fetch OIDC discovery document: %w", err)
+			return
+		}
+		defer resp.Body.Close()
+
+		if resp.StatusCode != http.StatusOK {
+			oidcDiscoveryErr = fmt.Errorf("OIDC discovery document request failed with status %d", resp.StatusCode)
+			return
+		}
+
+		var doc OidcDiscoveryDocument
+		if err := json.NewDecoder(resp.Body).Decode(&doc); err != nil {
+			oidcDiscoveryErr = fmt.Errorf("failed to decode OIDC discovery document: %w", err)
+			return
+		}
+
+		// The discovery doc's issuer must match what we configured, or a
+		// misconfigured/compromised endpoint could point us at a different
+		// provider entirely.
+		if doc.Issuer != issuer {
+			oidcDiscoveryErr = fmt.Errorf("OIDC discovery document issuer mismatch: expected %s, got %s", issuer, doc.Issuer)
+			return
+		}
+
+		oidcDiscovery = doc
+	})
+
+	return oidcDiscovery, oidcDiscoveryErr
+}
+
+// GetOidcTokenEndpoint exposes the provider's token endpoint, used when
+// exchanging an authorization code for tokens.
+func GetOidcTokenEndpoint() string {
+	doc, err := getOidcDiscoveryDocument()
+	if err != nil {
+		return ""
+	}
+	return doc.TokenEndpoint
+}
+
+// getOidcJwks returns the provider's current JSON Web Key Set, refetching at
+// most once every oidcJwksTTL.
+func getOidcJwks(forceRefresh bool) (oidcJwkSet, error) {
+	if !forceRefresh {
+		oidcJwksMu.RLock()
+		fresh := time.Since(oidcJwksFetched) < oidcJwksTTL && len(oidcJwksCache.Keys) > 0
+		cached := oidcJwksCache
+		oidcJwksMu.RUnlock()
+		if fresh {
+			return cached, nil
+		}
+	}
+
+	doc, err := getOidcDiscoveryDocument()
+	if err != nil {
+		return oidcJwkSet{}, err
+	}
+	if doc.JwksUri == "" {
+		return oidcJwkSet{}, errors.New("OIDC discovery document did not include a jwks_uri")
+	}
+
+	resp, err := http.Get(doc.JwksUri)
+	if err != nil {
+		return oidcJwkSet{}, fmt.Errorf("failed to fetch OIDC JWKS: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return oidcJwkSet{}, fmt.Errorf("OIDC JWKS request failed with status %d", resp.StatusCode)
+	}
+
+	var set oidcJwkSet
+	if err := json.NewDecoder(resp.Body).Decode(&set); err != nil {
+		return oidcJwkSet{}, fmt.Errorf("failed to decode OIDC JWKS: %w", err)
+	}
+
+	oidcJwksMu.Lock()
+	oidcJwksCache = set
+	oidcJwksFetched = time.Now()
+	oidcJwksMu.Unlock()
+
+	return set, nil
+}
+
+func findOidcRsaPublicKey(set oidcJwkSet, kid string) (*rsa.PublicKey, error) {
+	for _, key := range set.Keys {
+		if key.Kty != "RSA" || key.Kid != kid {
+			continue
+		}
+
+		nBytes, err := base64.RawURLEncoding.DecodeString(key.N)
+		if err != nil {
+			return nil, fmt.Errorf("invalid JWK modulus: %w", err)
+		}
+		eBytes, err := base64.RawURLEncoding.DecodeString(key.E)
+		if err != nil {
+			return nil, fmt.Errorf("invalid JWK exponent: %w", err)
+		}
+
+		return &rsa.PublicKey{
+			N: new(big.Int).SetBytes(nBytes),
+			E: int(new(big.Int).SetBytes(eBytes).Int64()),
+		}, nil
+	}
+
+	return nil, fmt.Errorf("no matching JWK found for kid %q", kid)
+}
+
+// OidcIdTokenClaims holds the subset of standard OIDC claims we rely on.
+type OidcIdTokenClaims struct {
+	Iss           string
+	Sub           string
+	Email         string
+	EmailVerified bool
+	GivenName     string
+	FamilyName    string
+	Name          string
+	Picture       string
+}
+
+// rawOidcClaims is used for the initial decode since `aud` may legally be
+// either a string or an array of strings, and we need to normalize it before
+// checking it.
+type rawOidcClaims struct {
+	Iss           string          `json:"iss"`
+	Sub           string          `json:"sub"`
+	Aud           json.RawMessage `json:"aud"`
+	Exp           int64           `json:"exp"`
+	Email         string          `json:"email"`
+	EmailVerified bool            `json:"email_verified"`
+	GivenName     string          `json:"given_name"`
+	FamilyName    string          `json:"family_name"`
+	Name          string          `json:"name"`
+	Picture       string          `json:"picture"`
+}
+
+func normalizeOidcAud(raw json.RawMessage) []string {
+	var single string
+	if err := json.Unmarshal(raw, &single); err == nil {
+		return []string{single}
+	}
+	var multi []string
+	if err := json.Unmarshal(raw, &multi); err == nil {
+		return multi
+	}
+	return nil
+}
+
+// VerifyOidcIdToken validates an OIDC ID token's RS256 signature (against the
+// provider's published JWKS), issuer, audience, expiry, and verified-email
+// claim, then returns its claims.
+//
+// The ID token reaches us via the server-to-server authorization-code
+// exchange, but we still verify it fully rather than just decoding it:
+// skipping verification would let a compromised/misconfigured token endpoint,
+// or a MITM on that connection, forge arbitrary claims and sign in as anyone.
+func VerifyOidcIdToken(idToken string) (OidcIdTokenClaims, error) {
+	if strings.TrimSpace(idToken) == "" {
+		return OidcIdTokenClaims{}, errors.New("id token is empty")
+	}
+
+	clientId := os.Getenv("OIDC_CLIENT_ID")
+	if clientId == "" {
+		return OidcIdTokenClaims{}, errors.New("OIDC_CLIENT_ID is not configured")
+	}
+
+	parts := strings.Split(idToken, ".")
+	if len(parts) != 3 {
+		return OidcIdTokenClaims{}, errors.New("malformed id token")
+	}
+
+	headerJson, err := base64.RawURLEncoding.DecodeString(parts[0])
+	if err != nil {
+		return OidcIdTokenClaims{}, fmt.Errorf("invalid id token header encoding: %w", err)
+	}
+	var header struct {
+		Alg string `json:"alg"`
+		Kid string `json:"kid"`
+	}
+	if err := json.Unmarshal(headerJson, &header); err != nil {
+		return OidcIdTokenClaims{}, fmt.Errorf("invalid id token header: %w", err)
+	}
+	// We only support RS256. Refuse anything else outright.
+	if header.Alg != "RS256" {
+		return OidcIdTokenClaims{}, fmt.Errorf("unsupported id token signing algorithm: %s", header.Alg)
+	}
+
+	signature, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		return OidcIdTokenClaims{}, fmt.Errorf("invalid id token signature encoding: %w", err)
+	}
+
+	pubKey, err := getOidcSigningKey(header.Kid)
+	if err != nil {
+		return OidcIdTokenClaims{}, err
+	}
+
+	signedInput := parts[0] + "." + parts[1]
+	hashed := sha256.Sum256([]byte(signedInput))
+	if err := rsa.VerifyPKCS1v15(pubKey, crypto.SHA256, hashed[:], signature); err != nil {
+		return OidcIdTokenClaims{}, errors.New("id token signature verification failed")
+	}
+
+	payloadJson, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return OidcIdTokenClaims{}, fmt.Errorf("invalid id token payload encoding: %w", err)
+	}
+	var raw rawOidcClaims
+	if err := json.Unmarshal(payloadJson, &raw); err != nil {
+		return OidcIdTokenClaims{}, fmt.Errorf("invalid id token payload: %w", err)
+	}
+
+	doc, err := getOidcDiscoveryDocument()
+	if err != nil {
+		return OidcIdTokenClaims{}, err
+	}
+	if raw.Iss != doc.Issuer {
+		return OidcIdTokenClaims{}, fmt.Errorf("unexpected id token issuer: %s", raw.Iss)
+	}
+
+	audOk := false
+	for _, aud := range normalizeOidcAud(raw.Aud) {
+		if aud == clientId {
+			audOk = true
+			break
+		}
+	}
+	if !audOk {
+		return OidcIdTokenClaims{}, errors.New("id token audience mismatch")
+	}
+
+	if raw.Exp == 0 || time.Now().After(time.Unix(raw.Exp, 0)) {
+		return OidcIdTokenClaims{}, errors.New("id token has expired")
+	}
+
+	if !raw.EmailVerified {
+		return OidcIdTokenClaims{}, errors.New("id token email is not verified by the provider")
+	}
+	if strings.TrimSpace(raw.Email) == "" {
+		return OidcIdTokenClaims{}, errors.New("id token did not include an email claim")
+	}
+
+	return OidcIdTokenClaims{
+		Iss:           raw.Iss,
+		Sub:           raw.Sub,
+		Email:         raw.Email,
+		EmailVerified: raw.EmailVerified,
+		GivenName:     raw.GivenName,
+		FamilyName:    raw.FamilyName,
+		Name:          raw.Name,
+		Picture:       raw.Picture,
+	}, nil
+}
+
+// getOidcSigningKey looks up the RSA public key for the given `kid`,
+// transparently forcing one JWKS refetch if it's not found in the cache
+// (keys may have rotated since we last fetched them).
+func getOidcSigningKey(kid string) (*rsa.PublicKey, error) {
+	set, err := getOidcJwks(false)
+	if err != nil {
+		return nil, err
+	}
+	if key, err := findOidcRsaPublicKey(set, kid); err == nil {
+		return key, nil
+	}
+
+	set, err = getOidcJwks(true)
+	if err != nil {
+		return nil, err
+	}
+	return findOidcRsaPublicKey(set, kid)
+}