diff --git a/services/api/src/auth/identity-provider.ts b/services/api/src/auth/identity-provider.ts
index 747c47a0..f50e8e48 100644
--- a/services/api/src/auth/identity-provider.ts
+++ b/services/api/src/auth/identity-provider.ts
@@ -46,6 +46,7 @@ export class ExternalIdentityProvider {
       url.search = new URLSearchParams({
         client_id: requiredConfig(this.config.githubOauthClientId),
         redirect_uri: callbackUrl(this.config),
+        scope: "user:email",
         state: transaction.state,
         code_challenge: challenge,
         code_challenge_method: "S256",
diff --git a/services/api/test/identity-provider.test.ts b/services/api/test/identity-provider.test.ts
index 60d5c2a8..5471eb77 100644
--- a/services/api/test/identity-provider.test.ts
+++ b/services/api/test/identity-provider.test.ts
@@ -65,6 +65,7 @@ describe("GitHub external identity integration", () => {
     const authorization = new URL(await provider.authorizationUrl(transaction));
     expect(authorization.searchParams.get("state")).toBe("state");
     expect(authorization.searchParams.get("code_challenge_method")).toBe("S256");
+    expect(authorization.searchParams.get("scope")).toBe("user:email");
     await expect(provider.exchange("code", transaction)).resolves.toEqual({
       provider: "github",
       githubUserId: "123",