diff --git a/deploy/production/README.md b/deploy/production/README.md
index 9d53f9c..9c2d106 100644
--- a/deploy/production/README.md
+++ b/deploy/production/README.md
@@ -19,9 +19,12 @@ absent from the production image. The release check requires a zero-finding
    reference pair is `glassboxhq.xyz` and `app.glassboxhq.xyz`.
 3. A GitHub OAuth App whose callback is
    `https://app.glassboxhq.xyz/oauth2/callback` (replace the host for another domain).
-   The reference proxy requests only `user:email`. Any authenticated GitHub user
-   becomes a read-only viewer; only usernames in `GITHUB_ADMIN_USERS` may change
-   the DataHub connection or issue and revoke ingestion keys.
+   The reference proxy requests `user:email read:org`. OAuth2 Proxy's GitHub
+   provider resolves organization membership while creating every session, so
+   `read:org` is required even though GlassBox does not restrict sign-in by
+   organization. Any authenticated GitHub user becomes a read-only viewer; only
+   usernames in `GITHUB_ADMIN_USERS` may change the DataHub connection or issue
+   and revoke ingestion keys.
 4. A scoped DataHub service account that can read catalog entities and upsert the
    GlassBox Document/Incident aspects used by the compiler and invalidation Action.
 5. A receipt signing key and matching operator trust policy.
diff --git a/deploy/production/compose.yml b/deploy/production/compose.yml
index 24a66fc..f0d0257 100644
--- a/deploy/production/compose.yml
+++ b/deploy/production/compose.yml
@@ -38,7 +38,9 @@ services:
       OAUTH2_PROXY_EMAIL_DOMAINS: "*"
       # Authentication is open to any GitHub account. Authorization remains in
       # GlassBox: authenticated users are viewers unless explicitly named below.
-      OAUTH2_PROXY_SCOPE: user:email
+      # OAuth2 Proxy still resolves GitHub organization membership while creating
+      # every session, so read:org is required even without an organization gate.
+      OAUTH2_PROXY_SCOPE: user:email read:org
       OAUTH2_PROXY_REVERSE_PROXY: "true"
       OAUTH2_PROXY_SET_XAUTHREQUEST: "true"
       OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
diff --git a/tests/unit/test_production_edge.py b/tests/unit/test_production_edge.py
index 40706df..7732ba5 100644
--- a/tests/unit/test_production_edge.py
+++ b/tests/unit/test_production_edge.py
@@ -67,6 +67,6 @@ def test_compose_binds_public_and_console_hosts_to_distinct_boundaries() -> None
         "https://${GLASSBOX_CONSOLE_DOMAIN:?set GLASSBOX_CONSOLE_DOMAIN}/oauth2/callback" in compose
     )
     assert "--github-user" not in compose
-    assert "OAUTH2_PROXY_SCOPE: user:email" in compose
+    assert "OAUTH2_PROXY_SCOPE: user:email read:org" in compose
     assert "GLASSBOX_ADMIN_USERS: ${GITHUB_ADMIN_USERS:-}" in compose
     assert "GITHUB_ALLOWED_USERS" not in compose