diff --git a/.changeset/serious-snails-poke.md b/.changeset/serious-snails-poke.md
new file mode 100644
index 0000000000..bcc8fadbf5
--- /dev/null
+++ b/.changeset/serious-snails-poke.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-gcp-iap-provider': patch
+---
+
+Add user id annotation sign-in resolver
diff --git a/plugins/auth-backend-module-gcp-iap-provider/api-report.md b/plugins/auth-backend-module-gcp-iap-provider/api-report.md
index 8d7c319a50..e282dd04b1 100644
--- a/plugins/auth-backend-module-gcp-iap-provider/api-report.md
+++ b/plugins/auth-backend-module-gcp-iap-provider/api-report.md
@@ -37,6 +37,10 @@ export namespace gcpIapSignInResolvers {
     GcpIapResult,
     unknown
   >;
+  const idMatchingUserEntityAnnotation: SignInResolverFactory<
+    GcpIapResult,
+    unknown
+  >;
 }
 
 // @public
diff --git a/plugins/auth-backend-module-gcp-iap-provider/src/resolvers.ts b/plugins/auth-backend-module-gcp-iap-provider/src/resolvers.ts
index 32ab2b6cc7..557ee8fdfe 100644
--- a/plugins/auth-backend-module-gcp-iap-provider/src/resolvers.ts
+++ b/plugins/auth-backend-module-gcp-iap-provider/src/resolvers.ts
@@ -46,4 +46,21 @@ export namespace gcpIapSignInResolvers {
       };
     },
   });
+
+  /**
+   * Looks up the user by matching their user ID to the `google.com/user-id` annotation.
+   */
+  export const idMatchingUserEntityAnnotation = createSignInResolverFactory({
+    create() {
+      return async (info: SignInInfo<GcpIapResult>, ctx) => {
+        const userId = info.result.iapToken.sub.split(':')[1];
+
+        return ctx.signInWithCatalogUser({
+          annotations: {
+            'google.com/user-id': userId,
+          },
+        });
+      };
+    },
+  });
 }