diff --git a/sp-modules/gitea/module.nix b/sp-modules/gitea/module.nix
index 29189e7..a415af1 100644
--- a/sp-modules/gitea/module.nix
+++ b/sp-modules/gitea/module.nix
@@ -396,7 +396,7 @@ in
           "https://${cfg.subdomain}.${sp.domain}/user/login?redirect_to=%2f";
         originUrl = redirect-uri;
         clientSystemdUnits = [ "forgejo.service" ];
-        enablePkce = false; # FIXME maybe Forgejo supports PKCE?
+        enablePkce = lib.versionAtLeast forgejoPackage.version "8.0";
         linuxUserOfClient = linuxUserOfService;
         linuxGroupOfClient = linuxGroupOfService;
         claimMaps.groups = {