diff --git a/config/settings.yml b/config/settings.yml
index 787a584c3..cc35b1df9 100644
--- a/config/settings.yml
+++ b/config/settings.yml
@@ -149,7 +149,7 @@ user-auth:
     #   timeout:        "_env:LDAPTIMEOUT:5"
     #   search-timeout: "_env:LDAPSEARCHTIME:5"
 
-single-sign-on: "_env:OIDC_SSO:true"
+single-sign-on: "_env:OIDC_SSO:false"
 
 # TODO: generalize for arbitrary auth protocols
 # TODO: maybe use separate pools for external databases?
diff --git a/src/Settings.hs b/src/Settings.hs
index 773071a5e..fdf67357c 100644
--- a/src/Settings.hs
+++ b/src/Settings.hs
@@ -634,7 +634,7 @@ instance FromJSON AppSettings where
         appUserAuthConf           <- o .: "user-auth"
         -- P.fromList . mapMaybe (assertM nonEmptyHost) <$> o .:? "user-database" .!= []
         appLdapPoolConf           <- o .:? "ldap-pool"
-        appSingleSignOn           <- o .: "single-sign-on"
+        appSingleSignOn           <- o .:? "single-sign-on" .!= False
         appLmsConf                <- o .: "lms-direct"
         appAvsConf                <- assertM (not . null . avsPass)  <$> o .:? "avs"
         appLprConf                <- o .: "lpr"