diff --git a/README.md b/README.md
index 2f52d0e..60cadce 100644
--- a/README.md
+++ b/README.md
@@ -47,3 +47,7 @@ LOG_LEVEL=warn
 Then follow [this guide](https://github.com/dani-garcia/vaultwarden/wiki/Fail2Ban-Setup).
 
 And you must use `COMPOSE_FILE="$COMPOSE_FILE:compose.host.yml"` in your traefik config to get real IPs.
+
+### Single Sign On with OpenID Connect (OIDC)
+
+Uncomment the "Single Sign On" section in your app config. See the [upstream docs](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect) for more, including specific configuration examples for Keycloak and Authentik.