diff --git a/apps/openwebui/release.yaml b/apps/openwebui/release.yaml
index 2314c4b..6100598 100644
--- a/apps/openwebui/release.yaml
+++ b/apps/openwebui/release.yaml
@@ -74,6 +74,10 @@ spec:
         value: "false"
       - name: OAUTH_MERGE_ACCOUNTS_BY_EMAIL
         value: "true"
+      - name: OAUTH_ALLOWED_ROLES
+        value: "user"
+      - name: OAUTH_AUTO_REDIRECT
+        value: "true"
       # STT via whisper-server (routed through llama-swap)
       - name: AUDIO_STT_ENGINE
         value: "openai"