diff --git a/infra/production/oracle/secrets/terragrunt.hcl b/infra/production/oracle/secrets/terragrunt.hcl
index ef1b934..068bfca 100644
--- a/infra/production/oracle/secrets/terragrunt.hcl
+++ b/infra/production/oracle/secrets/terragrunt.hcl
@@ -20,30 +20,32 @@ inputs = {
   }
 
   sources = {
-    dex_admin_password_hash    = { value = include.root.locals.secrets.dex_admin_password_hash }
-    dex_khuedoan_password_hash = { value = include.root.locals.secrets.dex_khuedoan_password_hash }
-    dex_argocd_client_secret   = { random = true }
-    dex_grafana_client_secret  = { random = true }
-    dex_kiali_client_secret    = { random = true }
-    dex_temporal_client_secret = { random = true }
-    dex_forgejo_client_key     = { value = "forgejo" }
-    dex_forgejo_client_secret  = { random = true }
-    forgejo_admin_username     = { value = "forgejo_admin" }
-    forgejo_admin_password     = { random = true }
-    silverbullet_user          = { value = include.root.locals.secrets.silverbullet_user }
-    wireguard_config           = { value = include.root.locals.secrets.wireguard_config }
+    dex_admin_password_hash     = { value = include.root.locals.secrets.dex_admin_password_hash }
+    dex_khuedoan_password_hash  = { value = include.root.locals.secrets.dex_khuedoan_password_hash }
+    dex_argocd_client_secret    = { random = true }
+    dex_grafana_client_secret   = { random = true }
+    dex_kiali_client_secret     = { random = true }
+    dex_temporal_client_secret  = { random = true }
+    dex_forgejo_client_key      = { value = "forgejo" }
+    dex_forgejo_client_secret   = { random = true }
+    dex_wireguard_client_secret = { random = true }
+    forgejo_admin_username      = { value = "forgejo_admin" }
+    forgejo_admin_password      = { random = true }
+    silverbullet_user           = { value = include.root.locals.secrets.silverbullet_user }
+    wireguard_config            = { value = include.root.locals.secrets.wireguard_config }
   }
 
   destinations = {
     "dex/dex-secrets" = {
       data = {
-        "ARGOCD_CLIENT_SECRET"   = "dex_argocd_client_secret"
-        "GRAFANA_CLIENT_SECRET"  = "dex_grafana_client_secret"
-        "KIALI_CLIENT_SECRET"    = "dex_kiali_client_secret"
-        "TEMPORAL_CLIENT_SECRET" = "dex_temporal_client_secret"
-        "FORGEJO_CLIENT_SECRET"  = "dex_forgejo_client_secret"
-        "ADMIN_PASSWORD_HASH"    = "dex_admin_password_hash"
-        "KHUEDOAN_PASSWORD_HASH" = "dex_khuedoan_password_hash"
+        "ARGOCD_CLIENT_SECRET"    = "dex_argocd_client_secret"
+        "GRAFANA_CLIENT_SECRET"   = "dex_grafana_client_secret"
+        "KIALI_CLIENT_SECRET"     = "dex_kiali_client_secret"
+        "TEMPORAL_CLIENT_SECRET"  = "dex_temporal_client_secret"
+        "FORGEJO_CLIENT_SECRET"   = "dex_forgejo_client_secret"
+        "WIREGUARD_CLIENT_SECRET" = "dex_wireguard_client_secret"
+        "ADMIN_PASSWORD_HASH"     = "dex_admin_password_hash"
+        "KHUEDOAN_PASSWORD_HASH"  = "dex_khuedoan_password_hash"
       }
     }
     "argocd/argocd-secret" = {
@@ -73,7 +75,7 @@ inputs = {
     }
     "wireguard/wireguard-secret" = {
       data = {
-        "wg0.conf" = "wireguard_config"
+        "SSO_CLIENT_SECRET" = "dex_wireguard_client_secret"
       }
     }
     "forgejo/forgejo-admin" = {
diff --git a/platform/production/dex.yaml b/platform/production/dex.yaml
index 9657112..88ed3ae 100644
--- a/platform/production/dex.yaml
+++ b/platform/production/dex.yaml
@@ -70,6 +70,11 @@ spec:
               redirectURIs:
                 - 'https://code.khuedoan.com/user/oauth2/SSO/callback'
               secretEnv: FORGEJO_CLIENT_SECRET
+            - id: wireguard
+              name: WireGuard
+              redirectURIs:
+                - 'https://wireguard.cloudlab.khuedoan.com/api/v0/auth/login/sso/callback'
+              secretEnv: WIREGUARD_CLIENT_SECRET
         envFrom:
           - secretRef:
               name: dex-secrets
diff --git a/platform/production/wireguard.yaml b/platform/production/wireguard.yaml
index f2a4478..2b36d93 100644
--- a/platform/production/wireguard.yaml
+++ b/platform/production/wireguard.yaml
@@ -23,8 +23,30 @@ spec:
     helm:
       valuesObject:
         config:
+          core:
+            create_default_peer: true
           web:
             external_url: https://wireguard.cloudlab.khuedoan.com
+          auth:
+            hide_login_form: true
+            oidc:
+              - id: sso
+                provider_name: sso
+                display_name: Login with SSO
+                registration_enabled: true
+                base_url: https://dex.cloudlab.khuedoan.com
+                client_id: wireguard
+                client_secret: $SSO_CLIENT_SECRET
+                extra_scopes:
+                  - profile
+                  - email
+                field_map:
+                  is_admin: email
+                admin_mapping:
+                  admin_value_regex: ^admin@cloudlab.khuedoan.com$
+        envFrom:
+          - secretRef:
+              name: wireguard-secret
         ingress:
           enabled: true
           className: nginx