diff --git a/priv/repo/migrations/20260224180000_add_oidc_only_to_settings.exs b/priv/repo/migrations/20260224180000_add_oidc_only_to_settings.exs
new file mode 100644
index 0000000..3775ef6
--- /dev/null
+++ b/priv/repo/migrations/20260224180000_add_oidc_only_to_settings.exs
@@ -0,0 +1,20 @@
+defmodule Mv.Repo.Migrations.AddOidcOnlyToSettings do
+  @moduledoc """
+  Adds oidc_only flag to settings. When true and OIDC is configured,
+  the sign-in page shows only OIDC (password login is hidden).
+  """
+
+  use Ecto.Migration
+
+  def up do
+    alter table(:settings) do
+      add :oidc_only, :boolean, default: false, null: false
+    end
+  end
+
+  def down do
+    alter table(:settings) do
+      remove :oidc_only
+    end
+  end
+end