diff --git a/docs/auth/guest/provider.md b/docs/auth/guest/provider.md
new file mode 100644
index 0000000000..09c52fcd3b
--- /dev/null
+++ b/docs/auth/guest/provider.md
@@ -0,0 +1,65 @@
+---
+id: provider
+title: Guest Authentication Provider
+sidebar_label: Guest
+description: Adding a guest authentication provider in Backstage
+---
+
+Audience: Admins or developers
+
+## Summary
+
+The goal of this guide is to get you set up with a guest authentication provider that emits tokens. This is different than the old guest authentication that is purely stored on the frontend and does not have tokens. The main reason you'd want to use this provider is to use permissioned plugins.
+
+:::caution
+This provider should only ever be enabled for `development`. To prevent unauthorized access to your data, this package is _explicitly_ disabled for non-development environments.
+:::
+
+## Installation
+
+### Backend
+
+:::note
+This will only work with the new backend system. There is no support for this in the old backend.
+:::
+
+Add the `@backstage/plugin-auth-backend-module-guest-provider` to your backend installation.
+
+```
+yarn --cwd packages/backend add @backstage/plugin-auth-backend-module-guest-provider
+```
+
+Then, add it to your backend's `index.ts` file,
+
+```diff
+const backend = createBackend();
+
+backend.add('@backstage/plugin-auth-backend');
++backend.add('@backstage/plugin-auth-backend-module-guest-provider');
+
+await backend.start();
+```
+
+### Frontend
+
+Add the following to your `SignInPage` providers,
+
+```diff
+const providers = [
++  'guest',
+   ...
+]
+```
+
+### Config
+
+Similar to the other authentication providers, you have to enable the provider in config. Add the following to your `app-config.local.yaml`,
+
+```diff
+auth:
+    providers:
++       guest:
++           development: {}
+```
+
+We need to specify that the provider is enabled for the given environment, and as there are no config values for this provider yet, you can just specify an empty object.
diff --git a/microsite/sidebars.json b/microsite/sidebars.json
index 4f2724c0b6..fd13fcb57b 100644
--- a/microsite/sidebars.json
+++ b/microsite/sidebars.json
@@ -307,6 +307,7 @@
           "auth/gitlab/provider",
           "auth/google/provider",
           "auth/google/gcp-iap-auth",
+          "auth/guest/provider",
           "auth/okta/provider",
           "auth/oauth2-proxy/provider",
           "auth/onelogin/provider",
diff --git a/mkdocs.yml b/mkdocs.yml
index 2a17613672..a2b2749233 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -161,6 +161,7 @@ nav:
           - GitLab: 'auth/gitlab/provider.md'
           - Google: 'auth/google/provider.md'
           - Google IAP: 'auth/google/gcp-iap-auth.md'
+          - Guest: 'auth/guest/provider.md'
           - OAuth2Proxy: 'auth/oauth2-proxy/provider.md'
           - Okta: 'auth/okta/provider.md'
           - OneLogin: 'auth/onelogin/provider.md'
diff --git a/plugins/auth-backend-module-guest-provider/README.md b/plugins/auth-backend-module-guest-provider/README.md
index 20c1eb2f15..79591c987b 100644
--- a/plugins/auth-backend-module-guest-provider/README.md
+++ b/plugins/auth-backend-module-guest-provider/README.md
@@ -2,48 +2,6 @@
 
 This module provides a guest auth provider implementation for `@backstage/plugin-auth-backend`. This is meant to supersede the existing `'guest'` option for authentication that does not emit tokens and is completely stored as frontend state.
 
-**NOTE**: This provider should only ever be enabled for `development`. This package is explicitly disabled for non-development environments.
-
-## Installation
-
-### Backend
-
-#### New Backend
-
-```diff
-const backend = createBackend();
-...
-
-+backend.add(import('@backstage/plugin-auth-backend-module-guest-provider'));
-
-...
-backend.start();
-```
-
-### Frontend
-
-Add the following to your `SignInPage` providers,
-
-```diff
-const providers = [
-+  'guest',
-   ...
-]
-```
-
-### Config
-
-Similar to the other authentication providers, you have to enable the provider in config. Add the following to your `app-config.local.yaml`,
-
-```diff
-auth:
-    providers:
-+       guest:
-+           development: {}
-```
-
-We need to specify that the provider is enabled for the given environment, and as there are no config values for this provider yet, you can just specify an empty object.
-
 ## Links
 
 - [Backstage](https://backstage.io)
diff --git a/plugins/auth-backend-module-guest-provider/src/authenticator.ts b/plugins/auth-backend-module-guest-provider/src/authenticator.ts
index d33fc2c7c9..436b72617d 100644
--- a/plugins/auth-backend-module-guest-provider/src/authenticator.ts
+++ b/plugins/auth-backend-module-guest-provider/src/authenticator.ts
@@ -1,5 +1,3 @@
-import { createProxyAuthenticator } from '@backstage/plugin-auth-node';
-
 /*
  * Copyright 2024 The Backstage Authors
  *
@@ -15,6 +13,9 @@ import { createProxyAuthenticator } from '@backstage/plugin-auth-node';
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
+import { createProxyAuthenticator } from '@backstage/plugin-auth-node';
+
 export const guestAuthenticator = createProxyAuthenticator({
   defaultProfileTransform: async () => {
     return { profile: {} };