diff --git a/gerrit/Dockerfile.entrypoint-unprivileged b/gerrit/Dockerfile.entrypoint-unprivileged
index 78ca1f8..86574b1 100644
--- a/gerrit/Dockerfile.entrypoint-unprivileged
+++ b/gerrit/Dockerfile.entrypoint-unprivileged
@@ -2,4 +2,13 @@
 
 set -e
 
+if [ "${GITHUB_OAUTH_CLIENT_ID}" -a "${GITHUB_OAUTH_CLIENT_SECRET}" ]; then
+    git config -f /var/gerrit/etc/gerrit.config \
+        plugin.gerrit-oauth-provider-github-oauth.root-url "https://github.com/"
+    git config -f /var/gerrit/etc/gerrit.config \
+        plugin.gerrit-oauth-provider-github-oauth.client-id "${GITHUB_OAUTH_CLIENT_ID}"
+    git config -f /var/gerrit/etc/gerrit.config \
+        plugin.gerrit-oauth-provider-github-oauth.client-secret "${GITHUB_OAUTH_CLIENT_SECRET}"
+fi
+
 exec /entrypoint.sh "$@"
diff --git a/gerrit/environment.template b/gerrit/environment.template
index f8975aa..f0310e0 100644
--- a/gerrit/environment.template
+++ b/gerrit/environment.template
@@ -1,2 +1,6 @@
 # Set to publicly visible Gerrit URL
 # CANONICAL_WEB_URL=https://review.some.host/
+
+# Set to enable GitHub OAUTH
+# GITHUB_OAUTH_CLIENT_ID=
+# GITHUB_OAUTH_CLIENT_SECRET=
diff --git a/gerrit/gerrit-oauth-provider.jar b/gerrit/gerrit-oauth-provider.jar
new file mode 100644
index 0000000..8a35e3d
--- /dev/null
+++ b/gerrit/gerrit-oauth-provider.jar
Binary files differ