diff --git a/policies/sys/auth/admin.yaml b/policies/sys/auth/admin.yaml
index 026a0d7..9af620e 100644
--- a/policies/sys/auth/admin.yaml
+++ b/policies/sys/auth/admin.yaml
@@ -8,6 +8,24 @@ rules:
       - delete
       - read
       - list
+  # Enabling/tuning an auth mount is sudo-protected, and an exact path match
+  # wins over the wildcard above, so both rules repeat the full capability set.
+  - path: "sys/auth/oidc"
+    capabilities:
+      - create
+      - update
+      - delete
+      - read
+      - list
+      - sudo
+  - path: "sys/auth/oidc/tune"
+    capabilities:
+      - create
+      - update
+      - delete
+      - read
+      - list
+      - sudo
 
 auth:
   approle: