diff --git a/TODO.on.site b/TODO.on.site
index 3f1d935..39983d4 100644
--- a/TODO.on.site
+++ b/TODO.on.site
@@ -10,3 +10,4 @@
 * Set SIMPLEID_BASE_URL in `simpleid/www/config.php`
 * Make sure identities point to the right URL
 * Set CANONICAL_WEB_URL in `gerrit/environment`
+* Enable GitHub OAUTH in `gerrit/environment`
diff --git a/gerrit/Dockerfile.entrypoint-unprivileged b/gerrit/Dockerfile.entrypoint-unprivileged
index 78ca1f8..86574b1 100644
--- a/gerrit/Dockerfile.entrypoint-unprivileged
+++ b/gerrit/Dockerfile.entrypoint-unprivileged
@@ -2,4 +2,13 @@
 
 set -e
 
+if [ "${GITHUB_OAUTH_CLIENT_ID}" -a "${GITHUB_OAUTH_CLIENT_SECRET}" ]; then
+    git config -f /var/gerrit/etc/gerrit.config \
+        plugin.gerrit-oauth-provider-github-oauth.root-url "https://github.com/"
+    git config -f /var/gerrit/etc/gerrit.config \
+        plugin.gerrit-oauth-provider-github-oauth.client-id "${GITHUB_OAUTH_CLIENT_ID}"
+    git config -f /var/gerrit/etc/gerrit.config \
+        plugin.gerrit-oauth-provider-github-oauth.client-secret "${GITHUB_OAUTH_CLIENT_SECRET}"
+fi
+
 exec /entrypoint.sh "$@"
diff --git a/gerrit/environment.template b/gerrit/environment.template
index f8975aa..f0310e0 100644
--- a/gerrit/environment.template
+++ b/gerrit/environment.template
@@ -1,2 +1,6 @@
 # Set to publicly visible Gerrit URL
 # CANONICAL_WEB_URL=https://review.some.host/
+
+# Set to enable GitHub OAUTH
+# GITHUB_OAUTH_CLIENT_ID=
+# GITHUB_OAUTH_CLIENT_SECRET=
diff --git a/gerrit/gerrit-oauth-provider.jar b/gerrit/gerrit-oauth-provider.jar
new file mode 100644
index 0000000..8a35e3d
--- /dev/null
+++ b/gerrit/gerrit-oauth-provider.jar
Binary files differ
diff --git a/sourcearcade.yml b/sourcearcade.yml
index 2e3d279..ffb1279 100644
--- a/sourcearcade.yml
+++ b/sourcearcade.yml
@@ -46,6 +46,7 @@
       - ./gerrit/git/:/var/gerrit/git/:rw
       - ./gerrit/index/:/var/gerrit/index/:rw
       - ./gerrit/cache/:/var/gerrit/cache/:rw
+      - ./gerrit/gerrit-oauth-provider.jar:/var/gerrit/plugins/gerrit-oauth-provider.jar:ro
 networks:
   simpleidnet:
     driver: bridge