diff --git a/Docker/FreshRSS.Apache.conf b/Docker/FreshRSS.Apache.conf
index 5db17e91a..47587889a 100644
--- a/Docker/FreshRSS.Apache.conf
+++ b/Docker/FreshRSS.Apache.conf
@@ -40,6 +40,7 @@ CustomLog "|/var/www/FreshRSS/cli/sensitive-log.sh" combined_proxy
 	OIDCSessionType ${OIDC_SESSION_TYPE}
 
 	OIDCRedirectURI /i/oidc/
+	OIDCDefaultURL ${OIDC_DEFAULT_URL}
 	OIDCCryptoPassphrase ${OIDC_CLIENT_CRYPTO_KEY}
 
 	Define "Test_${OIDC_REMOTE_USER_CLAIM}"
diff --git a/Docker/entrypoint.sh b/Docker/entrypoint.sh
index b7c06c672..a79853d66 100755
--- a/Docker/entrypoint.sh
+++ b/Docker/entrypoint.sh
@@ -43,6 +43,7 @@ if [ -n "$OIDC_ENABLED" ] && [ "$OIDC_ENABLED" -ne 0 ]; then
 	export OIDC_SESSION_INACTIVITY_TIMEOUT="${OIDC_SESSION_INACTIVITY_TIMEOUT:-300}"
 	export OIDC_SESSION_MAX_DURATION="${OIDC_SESSION_MAX_DURATION:-27200}"
 	export OIDC_SESSION_TYPE="${OIDC_SESSION_TYPE:-server-cache}"
+	export OIDC_DEFAULT_URL="${OIDC_DEFAULT_URL:-/i/}"
 
 	# Debian
 	(which a2enmod >/dev/null && a2enmod -q auth_openidc) ||
diff --git a/docs/en/admins/16_OpenID-Connect.md b/docs/en/admins/16_OpenID-Connect.md
index da2488748..0394dd09c 100644
--- a/docs/en/admins/16_OpenID-Connect.md
+++ b/docs/en/admins/16_OpenID-Connect.md
@@ -46,6 +46,7 @@ OIDC support in Docker is activated by the presence of a non-empty non-zero `OID
 * `OIDC_SESSION_INACTIVITY_TIMEOUT`: Optional. Interval in seconds after which the session will be invalidated when no interaction has occurred. When not defined, the default is 300 seconds.
 * `OIDC_SESSION_MAX_DURATION`: Optional. Maximum duration of the application session. When not defined the default is 8 hours (3600 * 8 seconds). When set to 0, the session duration will be set equal to the expiry time of the ID token.
 * `OIDC_SESSION_TYPE`: Optional. OpenID Connect session storage type. See [mod_auth_openidc’s documentation for details](https://github.com/OpenIDC/mod_auth_openidc/blob/72c9f479c2d228477ff0a9518964f61879c83fb6/auth_openidc.conf#L587-L596).
+* `OIDC_DEFAULT_URL`: Optional. URL the user is redirected to when the OIDC module receives a callback whose anti-CSRF state has expired or cannot be matched, for example when an interactive login (external identity provider, MFA/step-up, or the user stepping away) takes longer than the state timeout. When not defined, the default is `/i/`, the FreshRSS index, so that an expired login restarts against the existing provider session instead of returning an HTTP 400 error page. Maps to mod_auth_openidc’s [`OIDCDefaultURL`](https://github.com/OpenIDC/mod_auth_openidc/blob/b2e99151bc695335089c8d4bfe5793624ac0732e/auth_openidc.conf#L786-L790).
 
 You may add additional custom configuration in a new `./FreshRSS/p/i/.htaccess` file.