diff --git a/.coverage b/.coverage
index f05cef0..c279b8d 100644
Binary files a/.coverage and b/.coverage differ
diff --git a/src/intervalsicu_mcp_ui/app.py b/src/intervalsicu_mcp_ui/app.py
index eb95a0c..384870b 100644
--- a/src/intervalsicu_mcp_ui/app.py
+++ b/src/intervalsicu_mcp_ui/app.py
@@ -40,7 +40,7 @@ def create_app(config: Config | None = None) -> FastAPI:
         server_metadata_url=f"{cfg.oidc_issuer}.well-known/openid-configuration",
         client_id=cfg.oidc_client_id,
         client_secret=cfg.oidc_client_secret,
-        client_kwargs={"scope": "openid email profile"},
+        client_kwargs={"scope": cfg.oidc_scopes},
     )
 
     app = FastAPI(title="Intervals.icu MCP portal")
diff --git a/src/intervalsicu_mcp_ui/config.py b/src/intervalsicu_mcp_ui/config.py
index cd46b57..1d1d143 100644
--- a/src/intervalsicu_mcp_ui/config.py
+++ b/src/intervalsicu_mcp_ui/config.py
@@ -16,6 +16,7 @@ class Config:
     session_secret: str
     admin_group: str
     intervals_api_base: str
+    oidc_scopes: str
 
 
 def load_config() -> Config:
@@ -28,4 +29,5 @@ def load_config() -> Config:
         session_secret=os.environ["SESSION_SECRET"],
         admin_group=os.environ.get("ADMIN_GROUP", "intervalsicu-mcp-admins"),
         intervals_api_base=os.environ.get("INTERVALS_API_BASE_URL", "https://intervals.icu/api/v1"),
+        oidc_scopes=os.environ.get("OIDC_SCOPES", "openid email profile groups"),
     )
diff --git a/tests/test_app.py b/tests/test_app.py
index c33e76f..e2d366f 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -40,6 +40,7 @@ def app_url(tmp_path, monkeypatch):
         session_secret="x" * 32,
         admin_group="intervalsicu-mcp-admins",
         intervals_api_base="https://intervals.icu/api/v1",
+        oidc_scopes="openid email profile groups",
     )
     return appmod.create_app(cfg), url