diff --git a/gateway/src/index.ts b/gateway/src/index.ts
index 2c29aea..02612a2 100644
--- a/gateway/src/index.ts
+++ b/gateway/src/index.ts
@@ -112,8 +112,17 @@ async function main(): Promise<void> {
   const db = new DatabaseService(config.dbPath);
   const oauth = new OAuthService(db, config.clientId, config.redirectUri);
 
+  // Collect additional redirect URIs needed by OIDC and forward-auth
+  const additionalRedirectUris: string[] = [];
+  if (config.oidc.enabled && config.oidc.issuer) {
+    additionalRedirectUris.push(`${config.oidc.issuer}/oauth/callback`);
+  }
+  if (config.forwardAuth.enabled && config.oidc.issuer) {
+    additionalRedirectUris.push(`${config.oidc.issuer}/auth/proxy/callback`);
+  }
+
   try {
-    await oauth.initialize();
+    await oauth.initialize(additionalRedirectUris);
     console.log('OAuth client initialized');
   } catch (error) {
     console.error('Failed to initialize OAuth client:', error);
diff --git a/gateway/src/services/oauth.ts b/gateway/src/services/oauth.ts
index 3734213..c45b141 100644
--- a/gateway/src/services/oauth.ts
+++ b/gateway/src/services/oauth.ts
@@ -34,17 +34,27 @@ export class OAuthService {
     this.redirectUri = redirectUri;
   }
 
-  async initialize(): Promise<void> {
+  async initialize(additionalRedirectUris?: string[]): Promise<void> {
     // Derive proxy callback from the primary redirect URI's base
     const baseUrl = this.redirectUri.replace(/\/[^/]*$/, '');
     const proxyCallbackUri = `${baseUrl}/proxy/callback`;
 
+    // Collect all redirect URIs: primary, proxy, and any additional (e.g. OIDC callback)
+    const redirectUris: [string, ...string[]] = [this.redirectUri, proxyCallbackUri];
+    if (additionalRedirectUris) {
+      for (const uri of additionalRedirectUris) {
+        if (!redirectUris.includes(uri)) {
+          redirectUris.push(uri);
+        }
+      }
+    }
+
     this.client = new NodeOAuthClient({
       clientMetadata: {
         client_id: this.clientId,
         client_name: 'ATAuth Gateway',
         client_uri: this.clientId,
-        redirect_uris: [this.redirectUri, proxyCallbackUri],
+        redirect_uris: redirectUris,
         grant_types: ['authorization_code', 'refresh_token'],
         response_types: ['code'],
         scope: 'atproto transition:generic',