diff --git a/inventory/host_vars/beDebianMain.yml b/inventory/host_vars/beDebianMain.yml
index 262e1f0..2175abf 100644
--- a/inventory/host_vars/beDebianMain.yml
+++ b/inventory/host_vars/beDebianMain.yml
@@ -43,6 +43,10 @@ dns_override:
 homeassistant_override:
   url: "home.be.urmel.de"
   proxy_ip: 172.16.0.0/12
+  oidc:
+    client_id: "{{ (bitwarden_records_urmel_services['Homeassistant'].fields | selectattr('name', '==', 'oidc_client_id') | first).value }}"
+    client_secret: "{{ (bitwarden_records_urmel_services['Homeassistant'].fields | selectattr('name', '==', 'oidc_client_secret') | first).value }}"
+    configure_url: "{{ (bitwarden_records_urmel_services['Homeassistant'].fields | selectattr('name', '==', 'oidc_url') | first).value }}"
   mqtt:
     zigbee2mqtt:
       zigbee_adapter_id: "usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_f4b015d959f3ef1199c2c61b6d9880ab-if00-port0"
diff --git a/roles/homeassistant/defaults/main.yml b/roles/homeassistant/defaults/main.yml
index af1a869..818bc3e 100644
--- a/roles/homeassistant/defaults/main.yml
+++ b/roles/homeassistant/defaults/main.yml
@@ -14,5 +14,9 @@ homeassistant_defaults:
     mosquitto:
       version: latest
       allow_anonymous: true
+  oidc:
+    client_id: ""
+    client_secret: ""
+    configure_url: ""
   mariadb:
     password: ""
diff --git a/roles/homeassistant/tasks/main.yml b/roles/homeassistant/tasks/main.yml
index abdf5fc..647bfa5 100644
--- a/roles/homeassistant/tasks/main.yml
+++ b/roles/homeassistant/tasks/main.yml
@@ -45,10 +45,14 @@
     mode: "0644"
 
 - name: template zigbee2mqtt config
-  template:
-    src: zigbee2mqtt/configuration.yaml.j2
-    dest: "{{ path }}/data/zigbee2mqtt/configuration.yaml"
+  ansible.builtin.blockinfile:
+    path: "{{ path }}/data/zigbee2mqtt/configuration.yaml"
+    create: true
     mode: "0644"
+    marker: "# Ansible {mark}"
+    marker_begin: start
+    marker_end: end
+    block: "{{ lookup('template', 'zigbee2mqtt/configuration.yaml.j2') }}"
 
 - name: Do configuration
   include_tasks: ensure_configuration.yml
diff --git a/roles/homeassistant/templates/homeassistant_configuration/auth_oidc.yaml.j2 b/roles/homeassistant/templates/homeassistant_configuration/auth_oidc.yaml.j2
new file mode 100644
index 0000000..96f78de
--- /dev/null
+++ b/roles/homeassistant/templates/homeassistant_configuration/auth_oidc.yaml.j2
@@ -0,0 +1,10 @@
+client_id: "{{ homeassistant.oidc.client_id }}"
+{% if homeassistant.oidc.client_secret %}
+client_secret: "{{ homeassistant.oidc.client_secret }}"
+{% endif %}
+discovery_url: "{{ homeassistant.oidc.configure_url }}"
+claims:
+    display_name: "preferred_username"
+    groups: groups
+roles:
+    admin: urmel-admin
diff --git a/roles/homeassistant/templates/zigbee2mqtt/configuration.yaml.j2 b/roles/homeassistant/templates/zigbee2mqtt/configuration.yaml.j2
index c2f71a4..8ab377a 100644
--- a/roles/homeassistant/templates/zigbee2mqtt/configuration.yaml.j2
+++ b/roles/homeassistant/templates/zigbee2mqtt/configuration.yaml.j2
@@ -1,5 +1,5 @@
-# Ansible managed
-homeassistant: true
+homeassistant:
+  enabled: true
 mqtt:
   base_topic: zigbee2mqtt
   server: 'mqtt://mosquitto:1883'
@@ -8,6 +8,6 @@ serial:
 advanced:
   log_level: info
 frontend:
-    enabled: true
-    auth_token: {{ homeassistant.mqtt.zigbee2mqtt.auth_token }}
+  enabled: true
+  auth_token: {{ homeassistant.mqtt.zigbee2mqtt.auth_token }}
 version: 5