diff --git a/lib/controllers.js b/lib/controllers.js
index a9c81fc..e7259d2 100644
--- a/lib/controllers.js
+++ b/lib/controllers.js
@@ -74,7 +74,7 @@ Controllers.editStrategy = async (req, res) => {
 
 	payload.enabled = !!req.body.enabled;
 
-	const checkboxes = ['forceUsernameViaEmail', 'usernameViaEmail', 'trustEmailVerified', 'syncFullname', 'syncPicture'];
+	const checkboxes = ['forceUsernameViaEmail', 'usernameViaEmail', 'trustEmailVerified', 'disableEmailFallback', 'syncFullname', 'syncPicture'];
 	checkboxes.forEach((prop) => {
 		payload[prop] = payload.hasOwnProperty(prop) && payload[prop] === 'on' ? 1 : 0;
 	});
diff --git a/library.js b/library.js
index 961bb15..d3e7fe9 100644
--- a/library.js
+++ b/library.js
@@ -218,7 +218,7 @@ OAuth.login = async (payload) => {
 		return ({ uid });
 	}
 
-	const { trustEmailVerified } = await OAuth.getStrategy(payload.name);
+	const { trustEmailVerified, disableEmailFallback } = await OAuth.getStrategy(payload.name);
 	const { email } = payload;
 	const email_verified =
 		parseInt(trustEmailVerified, 10) &&
@@ -226,7 +226,7 @@ OAuth.login = async (payload) => {
 
 
 	// Check for user via email fallback
-	if (email && email_verified) {
+	if (email && email_verified && !parseInt(disableEmailFallback, 10)) {
 		uid = await user.getUidByEmail(payload.email);
 	}
 
@@ -241,7 +241,11 @@ OAuth.login = async (payload) => {
 			await user.setUserField(uid, 'email', email);
 
 			if (email_verified) {
-				await user.email.confirmByUid(uid);
+				try {
+					await user.email.confirmByUid(uid);
+				} catch (err) {
+					winston.warn(`[plugin/sso-oauth2-multiple] Could not confirm ${email} for uid ${uid}: ${err.message}`);
+				}
 			}
 		}
 	}
diff --git a/static/templates/partials/edit-oauth2-strategy.tpl b/static/templates/partials/edit-oauth2-strategy.tpl
index dcc4f65..3650d31 100644
--- a/static/templates/partials/edit-oauth2-strategy.tpl
+++ b/static/templates/partials/edit-oauth2-strategy.tpl
@@ -121,6 +121,17 @@
 							<label for="trustEmailVerified" class="form-check-label">Automatically confirm emails when <code>email_verified</code> is true.</code></label>
 						</div>
 
+						<div class="form-check form-switch mb-3">
+							<input type="checkbox" class="form-check-input" id="disableEmailFallback" name="disableEmailFallback" {{{ if (./disableEmailFallback == "1") }}}checked{{{ end }}}>
+							<label for="disableEmailFallback" class="form-check-label">
+								Never attach this provider to an existing account that shares its email address
+								<p class="form-text">
+									A verified address is normally matched against existing users, so signing in with a
+									second provider joins the account already using that address.
+								</p>
+							</label>
+						</div>
+
 						<div class="mb-3">
 							<label class="form-label" for="idKey">Alternative <code>id</code> key</label>
 							<input type="text" id="idKey" name="idKey" title="Alternative id key" class="form-control" placeholder="e.g. auth0Id" value="{./idKey}">