diff --git a/plugins/auth-backend-module-guest-provider/README.md b/plugins/auth-backend-module-guest-provider/README.md
index 9c297aebe6..471b522859 100644
--- a/plugins/auth-backend-module-guest-provider/README.md
+++ b/plugins/auth-backend-module-guest-provider/README.md
@@ -2,7 +2,7 @@
 
 This module provides a guest auth provider implementation for `@backstage/plugin-auth-backend`. This is meant to supersede the existing `'guest'` option for authentication that does not emit tokens and is completely stored as frontend state.
 
-**NOTE**:
+**NOTE**: This provider should only ever be enabled for `development` or `test`. Enabling this for production is strongly discouraged as it would give everyone a way to bypass your other authentication methods.
 
 ## Installation
 
diff --git a/plugins/auth-backend-module-guest-provider/src/module.ts b/plugins/auth-backend-module-guest-provider/src/module.ts
index 69b5eba48d..ad5c8c95a0 100644
--- a/plugins/auth-backend-module-guest-provider/src/module.ts
+++ b/plugins/auth-backend-module-guest-provider/src/module.ts
@@ -30,6 +30,11 @@ export const authModuleGuestProvider = createBackendModule({
         providers: authProvidersExtensionPoint,
       },
       async init({ providers }) {
+        if (process.env.NODE_ENV === 'production') {
+          throw new Error(
+            'Guest provider does not support authenticating production workloads.',
+          );
+        }
         providers.registerProvider({
           providerId: 'guest',
           factory: createGuestAuthProviderFactory(),