diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/oauth/config.go b/control-plane-operator/controllers/hostedcontrolplane/v2/oauth/config.go
index ad89bc90169f..a3f2b66996ba 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/v2/oauth/config.go
+++ b/control-plane-operator/controllers/hostedcontrolplane/v2/oauth/config.go
@@ -12,6 +12,8 @@ import (
 	"github.com/openshift/hypershift/support/globalconfig"
 	"github.com/openshift/hypershift/support/k8sutil"
 
+	pki "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/pki"
+
 	osinv1 "github.com/openshift/api/osin/v1"
 
 	corev1 "k8s.io/api/core/v1"
@@ -72,7 +74,11 @@ func adaptOAuthConfig(cpContext component.WorkloadContext, cfg *osinv1.OsinServe
 	controlPlaneEndpoint := cpContext.HCP.Status.ControlPlaneEndpoint
 	cfg.OAuthConfig.MasterURL = masterUrl
 	cfg.OAuthConfig.MasterPublicURL = masterUrl
-	cfg.OAuthConfig.LoginURL = fmt.Sprintf("https://%s:%d", controlPlaneEndpoint.Host, controlPlaneEndpoint.Port)
+	loginHost := controlPlaneEndpoint.Host
+	if hcp := cpContext.HCP; hcp.Spec.KubeAPIServerDNSName != "" {
+		loginHost = hcp.Spec.KubeAPIServerDNSName
+	}
+	cfg.OAuthConfig.LoginURL = fmt.Sprintf("https://%s:%d", pki.AddBracketsIfIPv6(loginHost), controlPlaneEndpoint.Port)
 	// loginURLOverride can be used to specify an override for the oauth config login url. The need for this arises
 	// when the login a provider uses doesn't conform to the standard login url in hypershift. The only supported use case
 	// for this is IBMCloud Red Hat Openshift
diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/oauth/config_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/oauth/config_test.go
new file mode 100644
index 000000000000..f16cb07d82ba
--- /dev/null
+++ b/control-plane-operator/controllers/hostedcontrolplane/v2/oauth/config_test.go
@@ -0,0 +1,104 @@
+package oauth
+
+import (
+	"fmt"
+	"testing"
+
+	. "github.com/onsi/gomega"
+
+	hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1"
+	"github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/infra"
+	component "github.com/openshift/hypershift/support/controlplane-component"
+
+	osinv1 "github.com/openshift/api/osin/v1"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+func TestAdaptOAuthConfig_LoginURL(t *testing.T) {
+	const (
+		lbHost    = "10.71.22.118"
+		dnsName   = "api.ocp4.example.com"
+		oauthHost = "oauth.example.com"
+	)
+	var lbPort int32 = 6443
+
+	tests := []struct {
+		name               string
+		kubeAPIServerDNS   string
+		loginURLAnnotation string
+		expectedLoginURL   string
+	}{
+		{
+			name:             "no kubeAPIServerDNSName — uses controlPlaneEndpoint host",
+			kubeAPIServerDNS: "",
+			expectedLoginURL: fmt.Sprintf("https://%s:%d", lbHost, lbPort),
+		},
+		{
+			name:             "kubeAPIServerDNSName set — uses DNS name",
+			kubeAPIServerDNS: dnsName,
+			expectedLoginURL: fmt.Sprintf("https://%s:%d", dnsName, lbPort),
+		},
+		{
+			name:               "kubeAPIServerDNSName set but annotation override present — annotation wins",
+			kubeAPIServerDNS:   dnsName,
+			loginURLAnnotation: "https://iam.custom.ibm.com/login",
+			expectedLoginURL:   "https://iam.custom.ibm.com/login",
+		},
+		{
+			name:               "only annotation override, no DNS name — annotation used",
+			kubeAPIServerDNS:   "",
+			loginURLAnnotation: "https://iam.custom.ibm.com/login",
+			expectedLoginURL:   "https://iam.custom.ibm.com/login",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
+
+			hcp := &hyperv1.HostedControlPlane{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-hcp",
+					Namespace: "test-ns",
+				},
+				Spec: hyperv1.HostedControlPlaneSpec{
+					KubeAPIServerDNSName: tt.kubeAPIServerDNS,
+				},
+				Status: hyperv1.HostedControlPlaneStatus{
+					ControlPlaneEndpoint: hyperv1.APIEndpoint{
+						Host: lbHost,
+						Port: lbPort,
+					},
+				},
+			}
+			if tt.loginURLAnnotation != "" {
+				hcp.Annotations = map[string]string{
+					hyperv1.OauthLoginURLOverrideAnnotation: tt.loginURLAnnotation,
+				}
+			}
+
+			cpContext := component.WorkloadContext{
+				HCP: hcp,
+				InfraStatus: infra.InfrastructureStatus{
+					OAuthHost: oauthHost,
+					OAuthPort: 443,
+					APIPort:   lbPort,
+				},
+				Client: fake.NewClientBuilder().Build(),
+			}
+
+			cfg := &osinv1.OsinServerConfig{
+				OAuthConfig: osinv1.OAuthConfig{},
+			}
+
+			adaptOAuthConfig(cpContext, cfg)
+
+			g.Expect(cfg.OAuthConfig.LoginURL).To(Equal(tt.expectedLoginURL))
+			g.Expect(cfg.OAuthConfig.MasterURL).To(Equal(fmt.Sprintf("https://%s:%d", oauthHost, 443)))
+			g.Expect(cfg.OAuthConfig.MasterPublicURL).To(Equal(fmt.Sprintf("https://%s:%d", oauthHost, 443)))
+		})
+	}
+}