diff --git a/compose.yml b/compose.yml
index a6f2cb3..98beb33 100644
--- a/compose.yml
+++ b/compose.yml
@@ -265,6 +265,7 @@ services:
       OIDC_SITE_CLIENT_SECRET: ${OIDC_SITE_CLIENT_SECRET:?}
       OIDC_COOLIFY_CLIENT_SECRET: ${OIDC_COOLIFY_CLIENT_SECRET:?}
       OIDC_HEADSCALE_CLIENT_SECRET: ${OIDC_HEADSCALE_CLIENT_SECRET:?}
+      OIDC_FLUXWEB_CLIENT_SECRET: ${OIDC_FLUXWEB_CLIENT_SECRET:?}
     volumes:
       - ./ory/hydra/clients:/app/clients:ro
     # Plain-text secrets of the confidential clients; Hydra stores only their hashes.
diff --git a/deploy/k8s/ui.yaml b/deploy/k8s/ui.yaml
index 4bb2156..685527a 100644
--- a/deploy/k8s/ui.yaml
+++ b/deploy/k8s/ui.yaml
@@ -86,6 +86,7 @@ spec:
             - { name: OIDC_SITE_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_SITE_CLIENT_SECRET } } }
             - { name: OIDC_COOLIFY_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_COOLIFY_CLIENT_SECRET } } }
             - { name: OIDC_HEADSCALE_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_HEADSCALE_CLIENT_SECRET } } }
+            - { name: OIDC_FLUXWEB_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_FLUXWEB_CLIENT_SECRET } } }
           resources:
             requests: { cpu: 10m, memory: 48Mi }
           securityContext:
diff --git a/e2e/test.env b/e2e/test.env
index 3cdbe52..bdb63cb 100644
--- a/e2e/test.env
+++ b/e2e/test.env
@@ -16,6 +16,7 @@ SMTP_SENDER=noreply@bulbashenko.test
 OIDC_SITE_CLIENT_SECRET=test-site-secret
 OIDC_COOLIFY_CLIENT_SECRET=test-coolify-secret
 OIDC_HEADSCALE_CLIENT_SECRET=test-headscale-secret
+OIDC_FLUXWEB_CLIENT_SECRET=test-fluxweb-secret
 # The suite signs in many times a minute from one machine; the rate-limit test checks the per-client limit.
 AUTH_RATE_LIMIT_PER_CLIENT=60
 AUTH_RATE_LIMIT_TOTAL=1000
diff --git a/kustomization.yaml b/kustomization.yaml
index cb215b1..2a005a1 100644
--- a/kustomization.yaml
+++ b/kustomization.yaml
@@ -33,6 +33,7 @@ configMapGenerator:
     files:
       - ory/hydra/clients/bulbashenko-site.json
       - ory/hydra/clients/coolify.json
+      - ory/hydra/clients/flux-web.json
       - ory/hydra/clients/headscale.json
       - ory/hydra/clients/stalwart-webui.json
       - ory/hydra/clients/thunderbird.json
diff --git a/ory/hydra/clients/flux-web.json b/ory/hydra/clients/flux-web.json
new file mode 100644
index 0000000..d98b53c
--- /dev/null
+++ b/ory/hydra/clients/flux-web.json
@@ -0,0 +1,12 @@
+{
+  "client_id": "flux-web",
+  "client_name": "Flux (cluster GitOps UI)",
+  "client_secret": "${OIDC_FLUXWEB_CLIENT_SECRET}",
+  "token_endpoint_auth_method": "client_secret_basic",
+  "grant_types": ["authorization_code", "refresh_token"],
+  "response_types": ["code"],
+  "scope": "openid offline_access profile email groups",
+  "redirect_uris": ["https://flux.int.bulbashenko.com/oauth2/callback"],
+  "skip_consent": true,
+  "metadata": { "required_group": "infra-admins" }
+}