diff --git a/files/signup.js b/files/signup.js
new file mode 100644
index 0000000..c88faa7
--- /dev/null
+++ b/files/signup.js
@@ -0,0 +1,11 @@
+/* eom.dev: sign-in goes to Dex; sign-up goes through the membership site */
+(function(){var U='https://www.eom.dev/members';
+var LOGIN='a[href$="/login"],a[href*="/plugins/oidc-cnr/"][href*="/auth/"]';
+function fix(){
+ document.querySelectorAll('a[href$="/signup"],a[href*="/signup?"]').forEach(function(a){a.href=U;a.addEventListener('click',function(e){e.stopImmediatePropagation();},true);});
+ document.querySelectorAll(LOGIN).forEach(function(a){
+  if(a.dataset.eomSignup||a.closest('.eom-signup'))return; a.dataset.eomSignup='1';
+  var s=a.cloneNode(false); s.removeAttribute('data-eom-signup'); s.href=U; s.textContent='Sign up'; s.className=(a.className||'')+' eom-signup'; s.style.marginLeft='0.5rem';
+  a.insertAdjacentElement('afterend',s);});
+}
+new MutationObserver(fix).observe(document.documentElement,{childList:true,subtree:true}); fix();})();
diff --git a/tasks/main.yml b/tasks/main.yml
index ff37aef..1ea97ae 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -88,6 +88,16 @@
 
         instance:
           description: "PeerTube on eom.dev"
+          customizations:
+            # Adds "Sign up" -> www.eom.dev/members next to Log in.
+            javascript: "{{ lookup('ansible.builtin.file', role_path ~ '/files/signup.js') }}"
+
+        # Log in goes straight to Dex (oidc-cnr is the only external auth).
+        # Admin password login: /login?externalRedirect=false
+        client:
+          menu:
+            login:
+              redirect_on_single_external_auth: true
 
       ## Extra environment variables to set on Peertube
       ##
@@ -287,3 +297,32 @@
                   app.kubernetes.io/component: controller
                   app.kubernetes.io/name: ingress-nginx
 
+# oidc-cnr settings live in PeerTube's database; set the claims Dex sends.
+- name: Find the PeerTube pod
+  kubernetes.core.k8s_info:
+    kind: Pod
+    namespace: peertube
+    label_selectors:
+      - app.kubernetes.io/name=peertube
+    field_selectors:
+      - status.phase=Running
+  register: peertube_pods
+
+- name: Configure the oidc-cnr plugin for Dex
+  kubernetes.core.k8s_exec:
+    namespace: peertube
+    pod: "{{ peertube_pods.resources[0].metadata.name }}"
+    container: peertube
+    command: >-
+      node -e '
+      const {Client}=require("pg");
+      const c=new Client({host:process.env.PEERTUBE_DB_HOSTNAME||"peertube-postgresql",user:process.env.PEERTUBE_DB_USERNAME||"peertube",password:process.env.PEERTUBE_DB_PASSWORD,database:"peertube"+(process.env.PEERTUBE_DB_SUFFIX||"")});
+      (async()=>{await c.connect();
+      const r=await c.query("select settings from plugin where name=$1",["oidc-cnr"]);
+      if(!r.rows.length){console.log("oidc-cnr not installed");return c.end();}
+      const s=Object.assign(r.rows[0].settings||{},{"discover-url":"https://dex.eom.dev/.well-known/openid-configuration","client-id":"peertube","client-secret":process.argv[1],"scope":"openid email profile groups","group-property":"groups","allowed-group":"PeerTube Users","username-property":"preferred_username","display-name-property":"name","mail-property":"email","auth-display-name":"eom.dev account"});
+      await c.query("update plugin set settings=$1 where name=$2",[JSON.stringify(s),"oidc-cnr"]);await c.end();})().catch(e=>{console.error(e.message);process.exit(1)})'
+      {{ peertube_dex_client_secret | quote }}
+  changed_when: false
+  no_log: true
+