diff --git a/.changeset/light-bees-end.md b/.changeset/light-bees-end.md
new file mode 100644
index 0000000000..9fbbc44da0
--- /dev/null
+++ b/.changeset/light-bees-end.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes': patch
+---
+
+GitLab can now be used as an `oidcTokenProvider` for Kubernetes clusters
diff --git a/docs/auth/gitlab/provider.md b/docs/auth/gitlab/provider.md
index 5041e161c5..dc41617812 100644
--- a/docs/auth/gitlab/provider.md
+++ b/docs/auth/gitlab/provider.md
@@ -18,7 +18,11 @@ Settings for local development:
 
 - Name: Backstage (or your custom app name)
 - Redirect URI: `http://localhost:7007/api/auth/gitlab/handler/frame`
-- Scopes: `read_api` and `read_user`
+- Scopes: `read_user` for sign-in. If you also need ID tokens (e.g. if you are
+  using the Kubernetes plugin and have clusters with `authProvider: oidc` and
+  [`oidcTokenProvider:
+gitlab`](https://backstage.io/docs/features/kubernetes/configuration/#clustersoidctokenprovider-optional)),
+  add the `openid` scope.
 
 ## Configuration
 
diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md
index 837574aa9e..458637f316 100644
--- a/docs/features/kubernetes/configuration.md
+++ b/docs/features/kubernetes/configuration.md
@@ -160,8 +160,9 @@ auth:
         audience: ${AUTH_OKTA_AUDIENCE}
 ```
 
-The following values are supported out-of-the-box by the frontend: `google`, `microsoft`,
-`okta`, `onelogin`.
+The following values are supported out-of-the-box by the frontend: `gitlab` (the
+application whose `clientId` is used by the auth provider should be granted the
+`openid` scope), `google`, `microsoft`, `okta`, `onelogin`.
 
 Take note that `oidcTokenProvider` is just the issuer for the token, you can use any
 of these with an OIDC enabled cluster, like using `microsoft` as the issuer for a EKS
diff --git a/plugins/kubernetes/src/plugin.ts b/plugins/kubernetes/src/plugin.ts
index 124bff831b..e2b13f43fe 100644
--- a/plugins/kubernetes/src/plugin.ts
+++ b/plugins/kubernetes/src/plugin.ts
@@ -23,6 +23,7 @@ import {
   createRouteRef,
   discoveryApiRef,
   identityApiRef,
+  gitlabAuthApiRef,
   googleAuthApiRef,
   microsoftAuthApiRef,
   oktaAuthApiRef,
@@ -49,18 +50,21 @@ export const kubernetesPlugin = createPlugin({
     createApiFactory({
       api: kubernetesAuthProvidersApiRef,
       deps: {
+        gitlabAuthApi: gitlabAuthApiRef,
         googleAuthApi: googleAuthApiRef,
         microsoftAuthApi: microsoftAuthApiRef,
         oktaAuthApi: oktaAuthApiRef,
         oneloginAuthApi: oneloginAuthApiRef,
       },
       factory: ({
+        gitlabAuthApi,
         googleAuthApi,
         microsoftAuthApi,
         oktaAuthApi,
         oneloginAuthApi,
       }) => {
         const oidcProviders = {
+          gitlab: gitlabAuthApi,
           google: googleAuthApi,
           microsoft: microsoftAuthApi,
           okta: oktaAuthApi,