diff --git a/k8s-ng/core/vaultwarden/deployment.yaml b/k8s-ng/core/vaultwarden/deployment.yaml
index 4330ed4..11e26eb 100644
--- a/k8s-ng/core/vaultwarden/deployment.yaml
+++ b/k8s-ng/core/vaultwarden/deployment.yaml
@@ -25,11 +25,24 @@ spec:
               cpu: 100m
             limits:
               memory: 512Mi
+          # SSO is switched on by the optional Secret vaultwarden-sso, which holds
+          # SSO_ENABLED=true and SSO_CLIENT_SECRET (the secret of the Keycloak client
+          # "Vaultwarden"). Without it Vaultwarden starts with SSO off.
+          envFrom:
+            - secretRef:
+                name: vaultwarden-sso
+                optional: true
           env:
             - name: DOMAIN
               value: https://vw.btwiusearch.net
             - name: ORG_GROUPS_ENABLED
               value: "true"
+            - name: SSO_AUTHORITY
+              value: https://auth.hexor.cy/auth/realms/hexor
+            - name: SSO_CLIENT_ID
+              value: Vaultwarden
+            - name: SSO_SCOPES
+              value: openid profile email offline_access
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef: