diff --git a/coderd/externalauth/externalauth.go b/coderd/externalauth/externalauth.go
index 7a84b56e04752..8802b5d5f6108 100644
--- a/coderd/externalauth/externalauth.go
+++ b/coderd/externalauth/externalauth.go
@@ -469,6 +469,7 @@ func ConvertConfig(entries []codersdk.ExternalAuthConfig, accessURL *url.URL) ([
 			AppInstallURL:       entry.AppInstallURL,
 			DisplayName:         entry.DisplayName,
 			DisplayIcon:         entry.DisplayIcon,
+			ExtraTokenKeys:      entry.ExtraTokenKeys,
 		}
 
 		if entry.DeviceFlow {
@@ -521,6 +522,9 @@ func applyDefaultsToConfig(config *codersdk.ExternalAuthConfig) {
 	if config.DisplayIcon == "" {
 		config.DisplayIcon = defaults.DisplayIcon
 	}
+	if config.ExtraTokenKeys == nil || len(config.ExtraTokenKeys) == 0 {
+		config.ExtraTokenKeys = defaults.ExtraTokenKeys
+	}
 
 	// Apply defaults if it's still empty...
 	if config.ID == "" {