diff --git a/sp-modules/actual/module.nix b/sp-modules/actual/module.nix
index 733391d..53f5c60 100644
--- a/sp-modules/actual/module.nix
+++ b/sp-modules/actual/module.nix
@@ -192,8 +192,8 @@ in
       (lib.mkIf is-auth-enabled {
         services.actual = {
           settings = {
-            # permit openid logins
-            allowedLoginMethods = [ "openid" ];
+            # only permit openid logins
+            allowedLoginMethods = lib.mkForce [ "openid" ];
             # default to openid if enabled
             loginMethod = "openid";
             # SSO config