diff --git a/apps/api/src/app/auth/auth.module.ts b/apps/api/src/app/auth/auth.module.ts
index e2a71ca843..3be0db256e 100644
--- a/apps/api/src/app/auth/auth.module.ts
+++ b/apps/api/src/app/auth/auth.module.ts
@@ -22,6 +22,7 @@ import { AuthController } from './auth.controller';
 import { AuthService } from './auth.service';
 import { GoogleStrategy } from './google.strategy';
 import { JwtStrategy } from './jwt.strategy';
+import { getOidcDiscoveryUrl } from './oidc.helper';
 import { OidcStrategy } from './oidc.strategy';
 
 @Module({
@@ -94,15 +95,28 @@ import { OidcStrategy } from './oidc.strategy';
           // Fetch OIDC configuration from discovery endpoint
           try {
             const response = await fetchService.fetch(
-              `${issuer}/.well-known/openid-configuration`
+              getOidcDiscoveryUrl(issuer)
             );
 
+            if (!response.ok) {
+              throw new Error(
+                `OIDC discovery request failed with status ${response.status}`
+              );
+            }
+
             const config = (await response.json()) as {
               authorization_endpoint: string;
+              issuer: string;
               token_endpoint: string;
               userinfo_endpoint: string;
             };
 
+            if (config.issuer !== issuer) {
+              throw new Error(
+                'OIDC discovery response issuer does not match configured issuer'
+              );
+            }
+
             // Manual URLs take priority over discovered ones
             authorizationURL =
               manualAuthorizationUrl || config.authorization_endpoint;
diff --git a/apps/api/src/app/auth/oidc.helper.spec.ts b/apps/api/src/app/auth/oidc.helper.spec.ts
new file mode 100644
index 0000000000..9234f12c95
--- /dev/null
+++ b/apps/api/src/app/auth/oidc.helper.spec.ts
@@ -0,0 +1,20 @@
+import { getOidcDiscoveryUrl } from './oidc.helper';
+
+describe('getOidcDiscoveryUrl', () => {
+  it.each([
+    [
+      'https://auth.example.com',
+      'https://auth.example.com/.well-known/openid-configuration'
+    ],
+    [
+      'https://auth.example.com/',
+      'https://auth.example.com/.well-known/openid-configuration'
+    ],
+    [
+      'https://auth.example.com/application/o/ghostfolio/',
+      'https://auth.example.com/application/o/ghostfolio/.well-known/openid-configuration'
+    ]
+  ])('creates the discovery URL for %s', (issuer, expected) => {
+    expect(getOidcDiscoveryUrl(issuer)).toBe(expected);
+  });
+});
diff --git a/apps/api/src/app/auth/oidc.helper.ts b/apps/api/src/app/auth/oidc.helper.ts
new file mode 100644
index 0000000000..0b04f1a806
--- /dev/null
+++ b/apps/api/src/app/auth/oidc.helper.ts
@@ -0,0 +1,3 @@
+export function getOidcDiscoveryUrl(issuer: string) {
+  return `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`;
+}