diff --git a/docs/OIDC.md b/docs/OIDC.md
index 531bf340e..37bd51172 100644
--- a/docs/OIDC.md
+++ b/docs/OIDC.md
@@ -39,6 +39,15 @@ This exposes an issuer at `http://127.0.0.1:5556/dex` with:
 
 Point the OIDC settings screen at that issuer, save, and use the SSO button to exercise the full login flow.
 
+## Classic password login stays
+
+OIDC is optional. Pulse continues to ship with the familiar username/password flow:
+
+- First-run setup still prompts you to create an admin credential or you can pre-seed it via `PULSE_AUTH_USER` / `PULSE_AUTH_PASS`.
+- If OIDC is **enabled**, the login page shows both the password form and the **Continue with Single Sign-On** button. Either path issues the same session cookie (`pulse_session`).
+- To run **password-only**, leave OIDC disabled (the default). To go **OIDC-only**, set `DISABLE_AUTH=true` after you confirm SSO works.
+- The `allowedGroups`, `allowedDomains`, and `allowedEmails` settings only affect OIDC logins; password authentication continues to honour the account you created locally.
+
 ## Provider Cheat-Sheet
 
 You do not need to ship per-provider templates. Pulse speaks standard OIDC, so administrators bring their own identity provider and supply the issuer URL, client ID, and client secret they created for Pulse. Below are the high-level steps we tested against three common providers—share these with users who ask “what do I enter?”
diff --git a/frontend-modern/src/components/Settings/Settings.tsx b/frontend-modern/src/components/Settings/Settings.tsx
index 8fc35bb47..86570face 100644
--- a/frontend-modern/src/components/Settings/Settings.tsx
+++ b/frontend-modern/src/components/Settings/Settings.tsx
@@ -5,6 +5,7 @@ import { NodeModal } from './NodeModal';
 import { GenerateAPIToken } from './GenerateAPIToken';
 import { ChangePasswordModal } from './ChangePasswordModal';
 import { GuestURLs } from './GuestURLs';
+import { OIDCPanel } from './OIDCPanel';
 import { SettingsAPI } from '@/api/settings';
 import { NodesAPI } from '@/api/nodes';
 import { UpdatesAPI } from '@/api/updates';
@@ -1873,6 +1874,15 @@ const Settings: Component = () => {
                 </div>
               </Show>
               
+              <div class="rounded-lg border border-blue-200 dark:border-blue-900/60 bg-blue-50/60 dark:bg-blue-900/10 p-4 mb-6">
+                <h4 class="text-sm font-semibold text-blue-800 dark:text-blue-200 mb-1">Single Sign-On</h4>
+                <p class="text-xs text-blue-700 dark:text-blue-300">
+                  Enable OIDC to add an SSO button alongside the existing password login. Disable password auth later by setting <code class="px-1 py-0.5 bg-blue-100/70 dark:bg-blue-900/40 rounded">DISABLE_AUTH=true</code> once SSO is verified.
+                </p>
+              </div>
+
+              <OIDCPanel onConfigUpdated={loadSecurityStatus} />
+
               {/* Security setup now handled by first-run wizard */}
 
               {/* API Token - Show always to allow API access even when auth is disabled */}