diff --git a/.air.toml b/.air.toml
index 8e2e597..4e8c52c 100644
--- a/.air.toml
+++ b/.air.toml
@@ -7,7 +7,7 @@ args_bin = []
 bin = "./tmp/main"
 cmd = "go build -o ./tmp/main ./cmd/server/main.go"
 delay = 1000
-exclude_dir = ["assets", "tmp", "vendor", "testdata"]
+exclude_dir = ["assets", "tmp", "vendor", "testdata", "bin"]
 exclude_file = []
 exclude_regex = ["_test.go"]
 exclude_unchanged = false
diff --git a/README.md b/README.md
index e85b8f4..8586e63 100644
--- a/README.md
+++ b/README.md
@@ -33,12 +33,15 @@ templates/assets for single-binary deployment.
 
 Settings are sourced from environment variables (see [.env](./.env)).
 
-| Variable              | Required | Default       | Description                                           |
-| --------------------- | -------- | ------------- | ----------------------------------------------------- |
-| `AUTH_SESSION_SECRET` | Yes      | —             | Base64-encoded secret used to sign session cookies.   |
-| `AUTH_LISTEN_ADDR`    | No       | `:8000`       | Address the HTTP server binds to.                     |
-| `AUTH_ENV`            | No       | `development` | Environment label, controls logger source annotation. |
-| `AUTH_LOG_MODE`       | No       | `text`        | Structured log encoder (`text` or `json`).            |
+| Variable                    | Required    | Default       | Description                                                                   |
+| --------------------------- | ----------- | ------------- | ----------------------------------------------------------------------------- |
+| `AUTH_SESSION_SECRET`       | Yes         | —             | Base64-encoded secret used to sign session cookies.                           |
+| `AUTH_LISTEN_ADDR`          | No          | `:8000`       | Address the HTTP server binds to.                                             |
+| `AUTH_ENV`                  | No          | `development` | Environment label, controls logger source annotation.                         |
+| `AUTH_LOG_MODE`             | No          | `text`        | Structured log encoder (`text` or `json`).                                    |
+| `AUTH_GOOGLE_CLIENT_ID`     | Conditional | —             | Google OAuth 2.0 client ID; required when enabling Google social login.       |
+| `AUTH_GOOGLE_CLIENT_SECRET` | Conditional | —             | Google OAuth 2.0 client secret matching the ID above.                         |
+| `AUTH_GOOGLE_REDIRECT_URL`  | Conditional | —             | Registered redirect URL (e.g. `http://localhost:8000/login/google/callback`). |
 
 ## Project Layout
 
diff --git a/go.mod b/go.mod
index 91cdafb..68949d3 100644
--- a/go.mod
+++ b/go.mod
@@ -2,9 +2,12 @@ module github.com/rjnemo/auth
 
 go 1.25.1
 
-require github.com/go-chi/chi/v5 v5.2.3
+require (
+	github.com/go-chi/chi/v5 v5.2.3
+	golang.org/x/oauth2 v0.31.0
+)
 
 require (
-	cloud.google.com/go/compute/metadata v0.3.0 // indirect
-	golang.org/x/oauth2 v0.31.0 // indirect
+	cloud.google.com/go/compute/metadata v0.8.4 // indirect
+	golang.org/x/sys v0.36.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 412f8d5..e3d5226 100644
--- a/go.sum
+++ b/go.sum
@@ -1,6 +1,10 @@
-cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc=
-cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
+cloud.google.com/go/compute/metadata v0.8.4 h1:oXMa1VMQBVCyewMIOm3WQsnVd9FbKBtm8reqWRaXnHQ=
+cloud.google.com/go/compute/metadata v0.8.4/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 github.com/go-chi/chi/v5 v5.2.3 h1:WQIt9uxdsAbgIYgid+BpYc+liqQZGMHRaUwp0JUcvdE=
 github.com/go-chi/chi/v5 v5.2.3/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 golang.org/x/oauth2 v0.31.0 h1:8Fq0yVZLh4j4YA47vHKFTa9Ew5XIrCP8LC6UeNZnLxo=
 golang.org/x/oauth2 v0.31.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=