diff --git a/routers/web/auth/oauth.go b/routers/web/auth/oauth.go
index e8e5d2c54b..f287e0e900 100644
--- a/routers/web/auth/oauth.go
+++ b/routers/web/auth/oauth.go
@@ -668,6 +668,11 @@ func GrantApplicationOAuth(ctx *context.Context) {
 
 // OIDCWellKnown generates JSON so OIDC clients know Gitea's capabilities
 func OIDCWellKnown(ctx *context.Context) {
+	if !setting.OAuth2.Enabled {
+		ctx.Status(http.StatusNotFound)
+		return
+	}
+
 	ctx.Data["SigningKey"] = oauth2.DefaultSigningKey
 	ctx.Data["Issuer"] = strings.TrimSuffix(setting.AppURL, "/")
 	ctx.JSONTemplate("user/auth/oidc_wellknown")
diff --git a/tests/integration/oauth_test.go b/tests/integration/oauth_test.go
index 2b44863ec2..188b0426da 100644
--- a/tests/integration/oauth_test.go
+++ b/tests/integration/oauth_test.go
@@ -632,17 +632,29 @@ func TestSignInOAuthCallbackPKCE(t *testing.T) {
 	})
 }
 
-func TestWellKnownDocumentIssuerDoesNotEndWithASlash(t *testing.T) {
+func TestWellKnownOpenIDConfiguration(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-	req := NewRequest(t, "GET", "/.well-known/openid-configuration")
-	resp := MakeRequest(t, req, http.StatusOK)
-	type response struct {
-		Issuer string `json:"issuer"`
-	}
-	parsed := new(response)
 
-	DecodeJSON(t, resp, parsed)
-	assert.Equal(t, strings.TrimSuffix(setting.AppURL, "/"), parsed.Issuer)
+	t.Run("Issuer does not end with a slash", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		req := NewRequest(t, "GET", "/.well-known/openid-configuration")
+		resp := MakeRequest(t, req, http.StatusOK)
+		type response struct {
+			Issuer string `json:"issuer"`
+		}
+		parsed := new(response)
+
+		DecodeJSON(t, resp, parsed)
+		assert.Equal(t, strings.TrimSuffix(setting.AppURL, "/"), parsed.Issuer)
+	})
+
+	t.Run("Not found if OAuth2 is not enabled", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+		defer test.MockVariableValue(&setting.OAuth2.Enabled, false)()
+
+		MakeRequest(t, NewRequest(t, "GET", "/.well-known/openid-configuration"), http.StatusNotFound)
+	})
 }
 
 func TestSignInOAuthCallbackRedirectToEscaping(t *testing.T) {