diff --git a/pkg/coredata/migrations/20260713T140201Z.sql b/pkg/coredata/migrations/20260713T140201Z.sql
new file mode 100644
index 000000000..2505699b1
--- /dev/null
+++ b/pkg/coredata/migrations/20260713T140201Z.sql
@@ -0,0 +1,15 @@
+-- Copyright (c) 2026 Probo Inc <hello@probo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TYPE iam_oidc_provider ADD VALUE 'COMPLIANCE_PORTAL';
diff --git a/pkg/coredata/oauth2_client.go b/pkg/coredata/oauth2_client.go
index 67979b806..c1e457a01 100644
--- a/pkg/coredata/oauth2_client.go
+++ b/pkg/coredata/oauth2_client.go
@@ -479,6 +479,7 @@ INSERT INTO iam_oauth2_clients (
 ON CONFLICT (external_client_id) WHERE external_client_id IS NOT NULL DO UPDATE SET
 	client_name = EXCLUDED.client_name,
 	redirect_uris = EXCLUDED.redirect_uris,
+	scopes = EXCLUDED.scopes,
 	grant_types = EXCLUDED.grant_types,
 	response_types = EXCLUDED.response_types,
 	token_endpoint_auth_method = EXCLUDED.token_endpoint_auth_method,
diff --git a/pkg/coredata/oidc_provider.go b/pkg/coredata/oidc_provider.go
index c8d96965a..ed4b19290 100644
--- a/pkg/coredata/oidc_provider.go
+++ b/pkg/coredata/oidc_provider.go
@@ -28,8 +28,9 @@ import (
 type OIDCProvider string
 
 const (
-	OIDCProviderGoogle    OIDCProvider = "GOOGLE"
-	OIDCProviderMicrosoft OIDCProvider = "MICROSOFT"
+	OIDCProviderGoogle           OIDCProvider = "GOOGLE"
+	OIDCProviderMicrosoft        OIDCProvider = "MICROSOFT"
+	OIDCProviderCompliancePortal OIDCProvider = "COMPLIANCE_PORTAL"
 )
 
 var (
@@ -42,6 +43,7 @@ func OIDCProviders() []OIDCProvider {
 	return []OIDCProvider{
 		OIDCProviderGoogle,
 		OIDCProviderMicrosoft,
+		OIDCProviderCompliancePortal,
 	}
 }
 
@@ -49,7 +51,8 @@ func (v OIDCProvider) IsValid() bool {
 	switch v {
 	case
 		OIDCProviderGoogle,
-		OIDCProviderMicrosoft:
+		OIDCProviderMicrosoft,
+		OIDCProviderCompliancePortal:
 		return true
 	}