diff --git a/paperless/init.sls b/paperless/init.sls
index 3c193e7..6d9b64a 100644
--- a/paperless/init.sls
+++ b/paperless/init.sls
@@ -67,6 +67,9 @@ paperless-docker-container-running:
       # - PAPERLESS_ENABLE_HTTP_REMOTE_USER_API={{ salt['pillar.get']('', 'false') }}
       # - PAPERLESS_SECRET_KEY={{ salt['pillar.get']('paperless:webserver:environment:secret_key', 'change-me') }}
       # - PAPERLESS_URL={{ salt['pillar.get']('paperless:webserver:environment:url', 'https://paperless.flipdot.org') }}
+
+      - PAPERLESS_APPS="allauth.socialaccount.providers.openid_connect"
+      - PAPERLESS_SOCIALACCOUNT_PROVIDERS='{"openid_connect": {"APPS": [{"provider_id": "keycloak", "name": "Keycloak", "client_id": "paperless", "secret": {{ salt['pillar.get']('paperless:webserver:keycloak:client_secret', '<CLIENT_SECRET>') }}, "settings": {"server_url": {{ salt['pillar.get']('paperless:webserver:keycloak:server_url', 'https://<KEYCLOAK_SERVER>/realms/<REALM>/.well-known/openid-configuration') }} }}]}}'
     - restart: always
     - networks:
       - paperless-network
diff --git a/pillar.example b/pillar.example
index ea278a4..16311d4 100644
--- a/pillar.example
+++ b/pillar.example
@@ -36,6 +36,9 @@ paperless:
       # (if doing so please consider security measures such as reverse proxy)
       # url=https://paperless.flipdot.org
 
+    keycloak:
+      client_secret: <CLIENT_SECRET>
+      server_url: https://<KEYCLOAK_SERVER>/realms/<REALM>/.well-known/openid-configuration
   gotenberg:
     image:
       path: docker.io/gotenberg/gotenberg