diff --git a/docs/deployment.md b/docs/deployment.md
index 9559417..f308dce 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -53,7 +53,9 @@ Create these separately:
 
 The OAuth client secret authenticates the portal to Gitea. The package token
 is used only server-side while proxying an authorized file. Neither value is
-returned to a technician or Proxmox host.
+returned to a technician or Proxmox host. The broker requests only Gitea's
+`read:user` OAuth scope, which it uses to confirm the signed-in username
+against `TAPM_ALLOWED_GITEA_USERS`.
 
 ## 4. Broker configuration
 
diff --git a/internal/app/auth.go b/internal/app/auth.go
index 6ef9e27..7b32c5a 100644
--- a/internal/app/auth.go
+++ b/internal/app/auth.go
@@ -48,6 +48,7 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		"client_id":     {s.cfg.GiteaClientID},
 		"redirect_uri":  {redirectURI},
 		"response_type": {"code"},
+		"scope":         {"read:user"},
 		"state":         {state},
 	}
 	http.Redirect(