diff --git a/nix/host-modules/hive-matrix.nix b/nix/host-modules/hive-matrix.nix
index 4a7e9d5c..2ac05277 100644
--- a/nix/host-modules/hive-matrix.nix
+++ b/nix/host-modules/hive-matrix.nix
@@ -394,6 +394,62 @@ in
         '';
       };
     };
+
+    sso = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Let this homeserver delegate login to the swarm's authelia,
+          as an OIDC relying party ("matrix next-gen auth").
+
+          This **adds** a way in. Password login keeps working: an
+          identity provider that can take the homeserver offline when
+          it hiccups is a worse homeserver than one with two ways in.
+          Making authelia the only path is a separate, reversible
+          switch (tuwunel's `login_with_password`), deliberately not
+          folded in here.
+
+          ⚠️ Matrix SSO lives **inside** the homeserver, never behind a
+          forward-auth proxy: the client-server API is spoken by
+          non-browser clients holding matrix access tokens — every
+          agent's own `hive-matrix-daemon` — plus federation, and a
+          proxy in front of `/_matrix/` breaks all of it.
+        '';
+      };
+
+      clientId = lib.mkOption {
+        type = lib.types.str;
+        default = "tuwunel";
+        description = ''
+          OAuth2 client id this homeserver identifies itself with. Must
+          match the `id` of the corresponding entry in
+          `services.hyperhive.swarm.authelia.oidc.clients`.
+        '';
+      };
+
+      clientSecretFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "/var/lib/tuwunel-oidc/tuwunel.secret";
+        description = ''
+          Path **inside the matrix container** holding the client
+          secret's plaintext.
+
+          A path, never a value: an OIDC client secret has two holders
+          in two containers (authelia keeps a hash, this homeserver
+          needs the plaintext), and a literal written here would be
+          rendered into the world-readable nix store.
+
+          Required when `enable` is set — deliberately no fallback. A
+          homeserver that boots with SSO half-configured is worse than
+          one that fails to evaluate: tuwunel reads OIDC from its
+          config file rather than a database row, so a malformed block
+          can stop the server outright instead of merely hiding a
+          button.
+        '';
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {