diff --git a/packages/auth/env.ts b/packages/auth/env.ts
index 4a41e8594..6fb7048dd 100644
--- a/packages/auth/env.ts
+++ b/packages/auth/env.ts
@@ -40,6 +40,9 @@ export const env = createEnv({
           AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE: z.string().optional(),
           AUTH_OIDC_FORCE_USERINFO: createBooleanSchema(false),
           AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING: createBooleanSchema(false),
+          AUTH_OIDC_TOKEN_ENDPOINT_AUTH_METHOD: z
+            .enum(["client_secret_basic", "client_secret_post", "client_secret_jwt", "none"])
+            .default("client_secret_basic"),
         }
       : {}),
     ...(authProviders.includes("ldap")
diff --git a/packages/auth/providers/oidc/oidc-provider.ts b/packages/auth/providers/oidc/oidc-provider.ts
index c706d978f..f7f03d443 100644
--- a/packages/auth/providers/oidc/oidc-provider.ts
+++ b/packages/auth/providers/oidc/oidc-provider.ts
@@ -14,6 +14,9 @@ export const OidcProvider = (headers: ReadonlyHeaders | null): OIDCConfig<Profil
   type: "oidc",
   clientId: env.AUTH_OIDC_CLIENT_ID,
   clientSecret: env.AUTH_OIDC_CLIENT_SECRET,
+  client: {
+    token_endpoint_auth_method: env.AUTH_OIDC_TOKEN_ENDPOINT_AUTH_METHOD,
+  },
   issuer: env.AUTH_OIDC_ISSUER,
   allowDangerousEmailAccountLinking: env.AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING,
   authorization: {