diff --git a/docker-compose.yml b/docker-compose.yml
index e8298cf..90f610f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -51,6 +51,13 @@ services:
       GF_AUTH_GOOGLE_TOKEN_URL: "https://oauth2.googleapis.com/token"
       GF_AUTH_GOOGLE_API_URL: "https://openidconnect.googleapis.com/v1/userinfo"
       GF_AUTH_GOOGLE_ALLOW_SIGN_UP: "false"
+      # Match a Google login to a PRE-PROVISIONED user by email (the admin created
+      # via the API has no prior Google-auth linkage). Without this, Grafana 9.3+
+      # won't look up by email and instead tries to auto-create the user — which
+      # allow_sign_up=false then rejects ("signup is disabled"). Safe here: Google
+      # verifies email ownership and it's the only OAuth provider, so there's no
+      # cross-provider takeover vector the "insecure" name warns about.
+      GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP: "true"
     volumes:
       - ./grafana/provisioning:/etc/grafana/provisioning:ro
       - ./grafana/dashboards:/var/lib/grafana/dashboards:ro