diff --git a/roles/docker/templates/gitea-compose.yml.j2 b/roles/docker/templates/gitea-compose.yml.j2
index b5125fb..b42adfe 100644
--- a/roles/docker/templates/gitea-compose.yml.j2
+++ b/roles/docker/templates/gitea-compose.yml.j2
@@ -13,6 +13,9 @@ services:
       - GITEA__mailer__SMTP_PORT=465
       - GITEA__mailer__USER={{ smtp.username }}
       - GITEA__mailer__PASSWD={{ vault_smtp.password }}
+      # Legacy OpenID 2.0 login let anyone register despite DISABLE_REGISTRATION. Logins go through Pocket ID.
+      - GITEA__openid__ENABLE_OPENID_SIGNIN=false
+      - GITEA__openid__ENABLE_OPENID_SIGNUP=false
     restart: unless-stopped
     labels:
       mag37.dockcheck.update: true