diff --git a/.changeset/pretty-feet-explode.md b/.changeset/pretty-feet-explode.md
new file mode 100644
index 0000000000..46237068c5
--- /dev/null
+++ b/.changeset/pretty-feet-explode.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Allow users to override callback url of GitHub provider
diff --git a/docs/auth/github/provider.md b/docs/auth/github/provider.md
index 05726e8a4e..d8803e392d 100644
--- a/docs/auth/github/provider.md
+++ b/docs/auth/github/provider.md
@@ -50,6 +50,10 @@ The GitHub provider is a structure with three configuration keys:
 - `clientSecret`: The client secret tied to the generated client ID.
 - `enterpriseInstanceUrl` (optional): The base URL for a GitHub Enterprise
   instance, e.g. `https://ghe.<company>.com`. Only needed for GitHub Enterprise.
+- `callbackUrl` (optional): The callback url that GitHub will use when
+  initiating an OAuth flow, e.g.
+  `https://your-intermediate-service.com/handler`. Only needed if Backstage is
+  not the immediate receiver (e.g. one OAuth app for many backstage instances).
 
 ## Adding the provider to the Backstage frontend
 
diff --git a/plugins/auth-backend/src/providers/github/provider.ts b/plugins/auth-backend/src/providers/github/provider.ts
index b6b198b644..f1949eafa3 100644
--- a/plugins/auth-backend/src/providers/github/provider.ts
+++ b/plugins/auth-backend/src/providers/github/provider.ts
@@ -223,6 +223,7 @@ export const createGithubProvider = (
       const enterpriseInstanceUrl = envConfig.getOptionalString(
         'enterpriseInstanceUrl',
       );
+      const customCallbackUrl = envConfig.getOptionalString('callbackUrl');
       const authorizationUrl = enterpriseInstanceUrl
         ? `${enterpriseInstanceUrl}/login/oauth/authorize`
         : undefined;
@@ -232,7 +233,9 @@ export const createGithubProvider = (
       const userProfileUrl = enterpriseInstanceUrl
         ? `${enterpriseInstanceUrl}/api/v3/user`
         : undefined;
-      const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+      const callbackUrl =
+        customCallbackUrl ||
+        `${globalConfig.baseUrl}/${providerId}/handler/frame`;
 
       const catalogIdentityClient = new CatalogIdentityClient({
         catalogApi,