diff --git a/modules/oidc/src/main/scala/docspell/oidc/CodeFlowRoutes.scala b/modules/oidc/src/main/scala/docspell/oidc/CodeFlowRoutes.scala
index 531b0103..c0adcdd2 100644
--- a/modules/oidc/src/main/scala/docspell/oidc/CodeFlowRoutes.scala
+++ b/modules/oidc/src/main/scala/docspell/oidc/CodeFlowRoutes.scala
@@ -49,6 +49,7 @@ object CodeFlowRoutes {
                 CodeFlowConfig.resumeUri(req, cfg, config).asString
               )
               .withQuery("response_type", "code")
+              .withQuery("state", cfg.clientId)
             logger.debug(
               s"Redirecting to OAuth/OIDC provider ${cfg.providerId.id}: ${uri.asString}"
             ) *>