diff --git a/.changeset/eleven-walls-relate.md b/.changeset/eleven-walls-relate.md
new file mode 100644
index 0000000000..43c1d5dea9
--- /dev/null
+++ b/.changeset/eleven-walls-relate.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-oidc-provider': patch
+---
+
+Fixed a bug where the OIDC authenticator did not properly persist granted OAuth scopes.
diff --git a/plugins/auth-backend-module-oidc-provider/src/authenticator.ts b/plugins/auth-backend-module-oidc-provider/src/authenticator.ts
index ba6bc9d142..eddf57a55b 100644
--- a/plugins/auth-backend-module-oidc-provider/src/authenticator.ts
+++ b/plugins/auth-backend-module-oidc-provider/src/authenticator.ts
@@ -42,6 +42,7 @@ export type OidcAuthResult = {
 
 /** @public */
 export const oidcAuthenticator = createOAuthAuthenticator({
+  shouldPersistScopes: true,
   defaultProfileTransform: async (
     input: OAuthAuthenticatorResult<OidcAuthResult>,
   ) => ({
@@ -162,9 +163,6 @@ export const oidcAuthenticator = createOAuthAuthenticator({
     if (!tokenset.access_token) {
       throw new Error('Refresh failed');
     }
-    if (!tokenset.scope) {
-      tokenset.scope = input.scope;
-    }
     const userinfo = await client.userinfo(tokenset.access_token);
 
     return new Promise((resolve, reject) => {