diff --git a/apps/web/.env.example b/apps/web/.env.example
index aaf5fab4e..1249ec53c 100644
--- a/apps/web/.env.example
+++ b/apps/web/.env.example
@@ -1,4 +1,9 @@
 NEXT_PUBLIC_BACKEND_URL=https://api.supermemory.ai
 NEXT_PUBLIC_POSTHOG_KEY=
 EXA_API_KEY=
-XAI_API_KEY=
\ No newline at end of file
+XAI_API_KEY=
+
+# Social sign-in providers. Both are shown by default; set a flag to "false" to
+# hide that provider's button on self-hosted deployments.
+NEXT_PUBLIC_GOOGLE_AUTH_ENABLED=
+NEXT_PUBLIC_GITHUB_AUTH_ENABLED=
diff --git a/apps/web/app/(auth)/login/page.tsx b/apps/web/app/(auth)/login/page.tsx
index 8500a2365..76d6b8caa 100644
--- a/apps/web/app/(auth)/login/page.tsx
+++ b/apps/web/app/(auth)/login/page.tsx
@@ -25,6 +25,25 @@ import {
 	shouldUseReviewerPasswordLogin,
 } from "@/lib/reviewer-password-login"
 
+/**
+ * `NEXT_PUBLIC_<PROVIDER>_AUTH_ENABLED` is an opt-out switch, not an opt-in one:
+ * self-hosted deployments show every social provider by default, and an operator
+ * turns one off by setting the flag to a falsy value. Treating any other value as
+ * "enabled" keeps `..._AUTH_ENABLED=true` from hiding the provider it names.
+ */
+function isSocialProviderEnabled(flag: string | undefined): boolean {
+	if (flag === undefined || flag === "") return true
+	return flag !== "false" && flag !== "0"
+}
+
+const isGoogleAuthEnabled =
+	process.env.NEXT_PUBLIC_HOST_ID === "supermemory" ||
+	isSocialProviderEnabled(process.env.NEXT_PUBLIC_GOOGLE_AUTH_ENABLED)
+
+const isGithubAuthEnabled =
+	process.env.NEXT_PUBLIC_HOST_ID === "supermemory" ||
+	isSocialProviderEnabled(process.env.NEXT_PUBLIC_GITHUB_AUTH_ENABLED)
+
 function isMcpOAuthAuthorizeContext(sp: Pick<URLSearchParams, "get">): boolean {
 	return sp.get("response_type") === "code" && Boolean(sp.get("client_id"))
 }
@@ -475,8 +494,7 @@ export default function LoginPage() {
 										)}
 
 										<div className="flex flex-col gap-3">
-											{process.env.NEXT_PUBLIC_HOST_ID === "supermemory" ||
-											!process.env.NEXT_PUBLIC_GOOGLE_AUTH_ENABLED ? (
+											{isGoogleAuthEnabled ? (
 												<div className="w-full">
 													<LastUsedBadge show={lastUsedMethod === "google"} />
 													<ExternalAuthButton
@@ -532,8 +550,7 @@ export default function LoginPage() {
 													/>
 												</div>
 											) : null}
-											{process.env.NEXT_PUBLIC_HOST_ID === "supermemory" ||
-											!process.env.NEXT_PUBLIC_GITHUB_AUTH_ENABLED ? (
+											{isGithubAuthEnabled ? (
 												<div className="w-full">
 													<LastUsedBadge show={lastUsedMethod === "github"} />
 													<ExternalAuthButton