diff --git a/src/__tests__/pages/api/auth/[...nextauth].test.js b/src/__tests__/pages/api/auth/[...nextauth].test.js
index 7694f2b08..c1a4446cb 100644
--- a/src/__tests__/pages/api/auth/[...nextauth].test.js
+++ b/src/__tests__/pages/api/auth/[...nextauth].test.js
@@ -205,6 +205,7 @@ describe("pages/api/auth/[...nextauth]", () => {
       name: "My OIDC",
       type: "oauth",
       idToken: true,
+      checks: ["pkce", "state"],
       issuer: "https://issuer.example",
       wellKnown: "https://issuer.example/.well-known/openid-configuration",
       clientId: "client-id",
diff --git a/src/pages/api/auth/[...nextauth].js b/src/pages/api/auth/[...nextauth].js
index 2ada235d0..74e5c95e3 100644
--- a/src/pages/api/auth/[...nextauth].js
+++ b/src/pages/api/auth/[...nextauth].js
@@ -73,6 +73,7 @@ if (authEnabled) {
         name: process.env.HOMEPAGE_OIDC_NAME || "Homepage OIDC",
         type: "oauth",
         idToken: true,
+        checks: ["pkce", "state"],
         issuer: cleanedIssuer,
         wellKnown: `${cleanedIssuer}/.well-known/openid-configuration`,
         clientId,