diff --git a/tasks/gitea.yaml b/tasks/gitea.yaml
index 7cf7496..bb9e592 100644
--- a/tasks/gitea.yaml
+++ b/tasks/gitea.yaml
@@ -74,6 +74,19 @@
             bindPassword: "{{ openldap_readonly_password }}"
             usernameAttribute: uid
             publicSSHKeyAttribute: sshPublicKey
+        # Sign-in through Dex; only members of Gitea Users (sent in the groups
+        # claim) may log in. The name "Dex" fixes the callback URL
+        # /user/oauth2/Dex/callback registered in Dex.
+        oauth:
+          - name: Dex
+            provider: openidConnect
+            key: gitea
+            secret: "{{ gitea_dex_client_secret }}"
+            autoDiscoverUrl: https://dex.eom.dev/.well-known/openid-configuration
+            scopes: "openid profile email groups"
+            requiredClaimName: groups
+            requiredClaimValue: Gitea Users
+            groupClaimName: groups
         config:
           APP_NAME: "Gitea"
           service: