diff --git a/src/Orbit.Api/Controllers/OAuthController.cs b/src/Orbit.Api/Controllers/OAuthController.cs
index 0985ba7f..202d2d48 100644
--- a/src/Orbit.Api/Controllers/OAuthController.cs
+++ b/src/Orbit.Api/Controllers/OAuthController.cs
@@ -34,6 +34,7 @@ public partial class OAuthController(
     ILogger<OAuthController> logger) : ControllerBase
 {
     private const string InvalidRedirectUriError = "invalid_redirect_uri";
+    private const string MissingStateError = "invalid_request";
     private static readonly string[] SupportedResponseTypes = ["code"];
     private static readonly string[] SupportedGrantTypes = ["authorization_code"];
     private static readonly string[] SupportedCodeChallengeMethods = ["S256"];
@@ -116,7 +117,8 @@ public IActionResult Authorize(
         [FromQuery] string response_type,
         [FromQuery] string state,
         [FromQuery] string code_challenge,
-        [FromQuery] string code_challenge_method)
+        [FromQuery] string code_challenge_method,
+        [FromQuery] string? nonce = null)
     {
         if (response_type != "code")
             return BadRequest(new { error = "unsupported_response_type" });
@@ -127,10 +129,13 @@ public IActionResult Authorize(
         if (!IsRedirectUriAllowed(redirect_uri))
             return BadRequest(new { error = InvalidRedirectUriError });
 
+        if (string.IsNullOrEmpty(state))
+            return BadRequest(new { error = MissingStateError, error_description = "state is required for CSRF protection" });
+
         var googleClientId = googleSettings.Value.ClientId ?? "";
         var html = OAuthLoginPage.Render(
             client_id, redirect_uri, state,
-            code_challenge, code_challenge_method, googleClientId);
+            code_challenge, code_challenge_method, googleClientId, nonce);
 
         return Content(html, "text/html");
     }
@@ -150,7 +155,8 @@ public async Task<IActionResult> SendCode([FromBody] SendCodeRequest request, Ca
 
     public record VerifyCodeRequest(
         string Email, string Code,
-        string State, string CodeChallenge, string RedirectUri, string ClientId);
+        string State, string CodeChallenge, string RedirectUri, string ClientId,
+        string? Nonce = null);
 
     [HttpPost("/oauth/verify-code")]
     [DistributedRateLimit("auth")]
@@ -159,6 +165,9 @@ public async Task<IActionResult> VerifyCode([FromBody] VerifyCodeRequest request
         if (!IsRedirectUriAllowed(request.RedirectUri))
             return BadRequest(new { error = InvalidRedirectUriError });
 
+        if (string.IsNullOrEmpty(request.State))
+            return BadRequest(new { error = MissingStateError });
+
         var result = await mediator.Send(
             new VerifyCodeCommand(request.Email, request.Code), ct);
 
@@ -167,7 +176,7 @@ public async Task<IActionResult> VerifyCode([FromBody] VerifyCodeRequest request
 
         var loginResponse = result.Value;
         var authCode = authStore.CreateCode(
-            loginResponse.UserId, request.CodeChallenge, request.RedirectUri, request.ClientId);
+            loginResponse.UserId, request.CodeChallenge, request.RedirectUri, request.ClientId, request.Nonce);
 
         var separator = request.RedirectUri.Contains('?') ? "&" : "?";
         var redirectUrl = $"{request.RedirectUri}{separator}code={Uri.EscapeDataString(authCode)}&state={Uri.EscapeDataString(request.State)}";
@@ -177,7 +186,8 @@ public async Task<IActionResult> VerifyCode([FromBody] VerifyCodeRequest request
 
     public record GoogleAuthRequest(
         string Credential,
-        string State, string CodeChallenge, string RedirectUri, string ClientId);
+        string State, string CodeChallenge, string RedirectUri, string ClientId,
+        string? Nonce = null);
 
     [HttpPost("/oauth/google")]
     [DistributedRateLimit("auth")]
@@ -186,6 +196,9 @@ public async Task<IActionResult> GoogleAuth([FromBody] GoogleAuthRequest request
         if (!IsRedirectUriAllowed(request.RedirectUri))
             return BadRequest(new { error = InvalidRedirectUriError });
 
+        if (string.IsNullOrEmpty(request.State))
+            return BadRequest(new { error = MissingStateError });
+
         var client = httpClientFactory.CreateClient();
         var response = await client.GetAsync(
             $"https://oauth2.googleapis.com/tokeninfo?id_token={Uri.EscapeDataString(request.Credential)}", ct);
@@ -230,7 +243,7 @@ await ConcurrencyRetry.SaveWithRetryAsync(
         }
 
         var authCode = authStore.CreateCode(
-            user.Id, request.CodeChallenge, request.RedirectUri, request.ClientId);
+            user.Id, request.CodeChallenge, request.RedirectUri, request.ClientId, request.Nonce);
 
         var separator = request.RedirectUri.Contains('?') ? "&" : "?";
         var redirectUrl = $"{request.RedirectUri}{separator}code={Uri.EscapeDataString(authCode)}&state={Uri.EscapeDataString(request.State)}";
@@ -312,12 +325,16 @@ public async Task<IActionResult> Token(
         if (logger.IsEnabled(LogLevel.Information))
             LogOAuthApiKeyCreated(logger, entry.UserId, entry.ClientId);
 
-        return Ok(new
+        var response = new Dictionary<string, object>
         {
-            access_token = rawKey,
-            token_type = "Bearer",
-            scope = string.Join(' ', AgentScopes.ClaudeDefaultScopes)
-        });
+            ["access_token"] = rawKey,
+            ["token_type"] = "Bearer",
+            ["scope"] = string.Join(' ', AgentScopes.ClaudeDefaultScopes)
+        };
+        if (!string.IsNullOrEmpty(entry.Nonce))
+            response["nonce"] = entry.Nonce;
+
+        return Ok(response);
     }
 
     private bool IsRedirectUriAllowed(string redirectUri)
diff --git a/src/Orbit.Api/OAuth/OAuthAuthorizationStore.cs b/src/Orbit.Api/OAuth/OAuthAuthorizationStore.cs
index 1de3323e..d52d2419 100644
--- a/src/Orbit.Api/OAuth/OAuthAuthorizationStore.cs
+++ b/src/Orbit.Api/OAuth/OAuthAuthorizationStore.cs
@@ -20,12 +20,12 @@ public OAuthAuthorizationStore(ILogger<OAuthAuthorizationStore> logger)
         }, null, TimeSpan.FromMinutes(5), TimeSpan.FromMinutes(5));
     }
 
-    public string CreateCode(Guid userId, string codeChallenge, string redirectUri, string clientId)
+    public string CreateCode(Guid userId, string codeChallenge, string redirectUri, string clientId, string? nonce = null)
     {
         var code = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32))
             .Replace("+", "-").Replace("/", "_").TrimEnd('=');
 
-        var entry = new AuthorizationEntry(userId, codeChallenge, redirectUri, clientId, DateTime.UtcNow);
+        var entry = new AuthorizationEntry(userId, codeChallenge, redirectUri, clientId, nonce, DateTime.UtcNow);
         _codes[code] = entry;
         return code;
     }
@@ -72,4 +72,5 @@ public record AuthorizationEntry(
     string CodeChallenge,
     string RedirectUri,
     string ClientId,
+    string? Nonce,
     DateTime CreatedAt);
diff --git a/src/Orbit.Api/OAuth/OAuthLoginPage.cs b/src/Orbit.Api/OAuth/OAuthLoginPage.cs
index f1e67ee9..903c69ca 100644
--- a/src/Orbit.Api/OAuth/OAuthLoginPage.cs
+++ b/src/Orbit.Api/OAuth/OAuthLoginPage.cs
@@ -1,18 +1,22 @@
-using System.Net;
+using System.Text.Json;
 
 namespace Orbit.Api.OAuth;
 
 public static class OAuthLoginPage
 {
     public static string Render(string clientId, string redirectUri, string state,
-        string codeChallenge, string codeChallengeMethod, string googleClientId)
+        string codeChallenge, string codeChallengeMethod, string googleClientId, string? nonce = null)
     {
-        clientId = WebUtility.HtmlEncode(clientId);
-        redirectUri = WebUtility.HtmlEncode(redirectUri);
-        state = WebUtility.HtmlEncode(state);
-        codeChallenge = WebUtility.HtmlEncode(codeChallenge);
-        codeChallengeMethod = WebUtility.HtmlEncode(codeChallengeMethod);
-        googleClientId = WebUtility.HtmlEncode(googleClientId);
+        var oauthParamsJson = JsonSerializer.Serialize(new
+        {
+            clientId,
+            redirectUri,
+            state,
+            codeChallenge,
+            codeChallengeMethod,
+            nonce
+        });
+        var googleClientIdJson = JsonSerializer.Serialize(googleClientId);
 
         return $$"""
 <!DOCTYPE html>
@@ -283,14 +287,8 @@ Continue with Google
     </div>
 
     <script>
-        const oauthParams = {
-            clientId: '{{clientId}}',
-            redirectUri: '{{redirectUri}}',
-            state: '{{state}}',
-            codeChallenge: '{{codeChallenge}}',
-            codeChallengeMethod: '{{codeChallengeMethod}}'
-        };
-        const googleClientId = '{{googleClientId}}';
+        const oauthParams = {{oauthParamsJson}};
+        const googleClientId = {{googleClientIdJson}};
         let userEmail = '';
         let resendTimer = null;
 
@@ -415,7 +413,8 @@ async function verifyCode() {
                         state: oauthParams.state,
                         codeChallenge: oauthParams.codeChallenge,
                         redirectUri: oauthParams.redirectUri,
-                        clientId: oauthParams.clientId
+                        clientId: oauthParams.clientId,
+                        nonce: oauthParams.nonce
                     })
                 });
                 const data = await res.json();
@@ -458,7 +457,8 @@ async function handleGoogleCredential(response) {
                         state: oauthParams.state,
                         codeChallenge: oauthParams.codeChallenge,
                         redirectUri: oauthParams.redirectUri,
-                        clientId: oauthParams.clientId
+                        clientId: oauthParams.clientId,
+                        nonce: oauthParams.nonce
                     })
                 });
                 const data = await res.json();
diff --git a/src/Orbit.Api/openapi.json b/src/Orbit.Api/openapi.json
index 926afd88..32c407d1 100644
--- a/src/Orbit.Api/openapi.json
+++ b/src/Orbit.Api/openapi.json
@@ -8635,6 +8635,13 @@
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "name": "nonce",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
diff --git a/tests/Orbit.Infrastructure.Tests/Controllers/OAuthControllerTests.cs b/tests/Orbit.Infrastructure.Tests/Controllers/OAuthControllerTests.cs
index cde09e0c..e46ee49c 100644
--- a/tests/Orbit.Infrastructure.Tests/Controllers/OAuthControllerTests.cs
+++ b/tests/Orbit.Infrastructure.Tests/Controllers/OAuthControllerTests.cs
@@ -727,6 +727,193 @@ public async Task VerifyCode_RejectsUnallowlistedHosts(string redirectUri)
         json.Should().Contain("invalid_redirect_uri");
     }
 
+    [Fact]
+    public void Authorize_MissingState_ReturnsBadRequest()
+    {
+        var result = _controller.Authorize(
+            "client-123", "https://claude.ai/callback", "code",
+            "", "challenge-xyz", "S256");
+
+        var bad = result.Should().BeOfType<BadRequestObjectResult>().Subject;
+        JsonSerializer.Serialize(bad.Value).Should().Contain("invalid_request");
+    }
+
+    [Fact]
+    public async Task VerifyCode_MissingState_ReturnsBadRequestAndDoesNotVerifyCode()
+    {
+        var request = new OAuthController.VerifyCodeRequest(
+            "test@example.com", "123456", "",
+            "challenge-xyz", "https://claude.ai/callback", "client-123");
+
+        var result = await _controller.VerifyCode(request, CancellationToken.None);
+
+        var bad = result.Should().BeOfType<BadRequestObjectResult>().Subject;
+        JsonSerializer.Serialize(bad.Value).Should().Contain("invalid_request");
+        await _mediator.DidNotReceive().Send(Arg.Any<VerifyCodeCommand>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GoogleAuth_MissingState_ReturnsBadRequestBeforeCallingGoogle()
+    {
+        var request = new OAuthController.GoogleAuthRequest(
+            "valid-token", "", "challenge-xyz",
+            "https://claude.ai/callback", "client-123");
+
+        var result = await _controller.GoogleAuth(request, CancellationToken.None);
+
+        var bad = result.Should().BeOfType<BadRequestObjectResult>().Subject;
+        JsonSerializer.Serialize(bad.Value).Should().Contain("invalid_request");
+        _httpClientFactory.DidNotReceive().CreateClient();
+    }
+
+    [Fact]
+    public async Task VerifyCode_EchoesStateVerbatim_SoClientCanDetectMismatch()
+    {
+        var state = "state-" + Guid.NewGuid().ToString("N");
+        var loginResponse = new LoginResponse(UserId, "jwt-token", "Thomas", "test@example.com");
+        _mediator.Send(Arg.Any<VerifyCodeCommand>(), Arg.Any<CancellationToken>())
+            .Returns(Result.Success(loginResponse));
+
+        var request = new OAuthController.VerifyCodeRequest(
+            "test@example.com", "123456", state,
+            "challenge-xyz", "https://claude.ai/callback", "client-123");
+
+        var redirectUrl = ExtractRedirectUrl(await _controller.VerifyCode(request, CancellationToken.None));
+
+        ExtractQueryParam(redirectUrl, "state").Should().Be(state);
+        redirectUrl.Should().NotContain("tampered-state");
+    }
+
+    [Fact]
+    public async Task VerifyCode_StateWithQueryInjection_IsPercentEncodedSoNoParamSmuggling()
+    {
+        var tamperedState = "benign&code=forged-code&x=";
+        var loginResponse = new LoginResponse(UserId, "jwt-token", "Thomas", "test@example.com");
+        _mediator.Send(Arg.Any<VerifyCodeCommand>(), Arg.Any<CancellationToken>())
+            .Returns(Result.Success(loginResponse));
+
+        var request = new OAuthController.VerifyCodeRequest(
+            "test@example.com", "123456", tamperedState,
+            "challenge-xyz", "https://claude.ai/callback", "client-123");
+
+        var redirectUrl = ExtractRedirectUrl(await _controller.VerifyCode(request, CancellationToken.None));
+
+        redirectUrl.Should().Contain("state=benign%26code%3Dforged-code");
+        redirectUrl.Should().NotContain("&code=forged-code");
+        ExtractQueryParam(redirectUrl, "code").Should().NotBe("forged-code");
+        ExtractQueryParam(redirectUrl, "state").Should().Be(tamperedState);
+    }
+
+    [Fact]
+    public async Task Token_WithNonce_EchoesNonceInResponse()
+    {
+        var (verifier, challenge) = GeneratePkce();
+        var code = _authStore.CreateCode(
+            UserId, challenge, "https://claude.ai/callback", "client-123", "replay-nonce");
+
+        var result = await _controller.Token(
+            "authorization_code", code, verifier,
+            "client-123", "https://claude.ai/callback", CancellationToken.None);
+
+        var ok = result.Should().BeOfType<OkObjectResult>().Subject;
+        var json = JsonSerializer.Serialize(ok.Value);
+        json.Should().Contain("nonce");
+        json.Should().Contain("replay-nonce");
+    }
+
+    [Fact]
+    public async Task Token_WithoutNonce_OmitsNonceFromResponse()
+    {
+        var (verifier, challenge) = GeneratePkce();
+        var code = _authStore.CreateCode(
+            UserId, challenge, "https://claude.ai/callback", "client-123");
+
+        var result = await _controller.Token(
+            "authorization_code", code, verifier,
+            "client-123", "https://claude.ai/callback", CancellationToken.None);
+
+        var ok = result.Should().BeOfType<OkObjectResult>().Subject;
+        JsonSerializer.Serialize(ok.Value).Should().NotContain("nonce");
+    }
+
+    [Fact]
+    public async Task VerifyCode_WithNonce_BindsNonceRetrievableAtTokenExchange()
+    {
+        var (verifier, challenge) = GeneratePkce();
+        var loginResponse = new LoginResponse(UserId, "jwt-token", "Thomas", "test@example.com");
+        _mediator.Send(Arg.Any<VerifyCodeCommand>(), Arg.Any<CancellationToken>())
+            .Returns(Result.Success(loginResponse));
+
+        var request = new OAuthController.VerifyCodeRequest(
+            "test@example.com", "123456", "state-abc", challenge,
+            "https://claude.ai/callback", "client-123", Nonce: "verify-nonce-7");
+        var code = ExtractQueryParam(
+            ExtractRedirectUrl(await _controller.VerifyCode(request, CancellationToken.None)), "code");
+
+        var tokenResult = await _controller.Token(
+            "authorization_code", code, verifier,
+            "client-123", "https://claude.ai/callback", CancellationToken.None);
+
+        var ok = tokenResult.Should().BeOfType<OkObjectResult>().Subject;
+        JsonSerializer.Serialize(ok.Value).Should().Contain("verify-nonce-7");
+    }
+
+    [Fact]
+    public async Task GoogleAuth_WithNonce_BindsNonceRetrievableAtTokenExchange()
+    {
+        var (verifier, challenge) = GeneratePkce();
+        var user = User.Create("Thomas", "test@example.com").Value;
+        var mockHandler = new MockHttpMessageHandler(HttpStatusCode.OK,
+            """{"email":"test@example.com","aud":"test-google-client-id","name":"Thomas"}""");
+        _httpClientFactory.CreateClient().Returns(new HttpClient(mockHandler));
+        _userRepo.FindOneTrackedIgnoringFiltersAsync(
+            Arg.Any<System.Linq.Expressions.Expression<Func<User, bool>>>(),
+            Arg.Any<CancellationToken>())
+            .Returns(user);
+
+        var request = new OAuthController.GoogleAuthRequest(
+            "valid-token", "state-abc", challenge,
+            "https://claude.ai/callback", "client-123", Nonce: "google-nonce-42");
+        var code = ExtractQueryParam(
+            ExtractRedirectUrl(await _controller.GoogleAuth(request, CancellationToken.None)), "code");
+
+        var tokenResult = await _controller.Token(
+            "authorization_code", code, verifier,
+            "client-123", "https://claude.ai/callback", CancellationToken.None);
+
+        var ok = tokenResult.Should().BeOfType<OkObjectResult>().Subject;
+        JsonSerializer.Serialize(ok.Value).Should().Contain("google-nonce-42");
+    }
+
+    private static (string verifier, string challenge) GeneratePkce()
+    {
+        var verifier = Convert.ToBase64String(System.Security.Cryptography.RandomNumberGenerator.GetBytes(32))
+            .Replace("+", "-").Replace("/", "_").TrimEnd('=');
+        var hash = System.Security.Cryptography.SHA256.HashData(Encoding.ASCII.GetBytes(verifier));
+        var challenge = Convert.ToBase64String(hash)
+            .Replace("+", "-").Replace("/", "_").TrimEnd('=');
+        return (verifier, challenge);
+    }
+
+    private static string ExtractRedirectUrl(IActionResult result)
+    {
+        var ok = result.Should().BeOfType<OkObjectResult>().Subject;
+        using var doc = JsonDocument.Parse(JsonSerializer.Serialize(ok.Value));
+        return doc.RootElement.GetProperty("redirectUrl").GetString()!;
+    }
+
+    private static string ExtractQueryParam(string url, string key)
+    {
+        var query = url[(url.IndexOf('?') + 1)..];
+        foreach (var pair in query.Split('&'))
+        {
+            var parts = pair.Split('=', 2);
+            if (parts[0] == key)
+                return parts.Length == 2 ? Uri.UnescapeDataString(parts[1]) : string.Empty;
+        }
+        return string.Empty;
+    }
+
     private sealed class FakeUniqueViolationException : DbException
     {
         public override string SqlState => "23505";
diff --git a/tests/Orbit.Infrastructure.Tests/Services/OAuthAuthorizationStoreTests.cs b/tests/Orbit.Infrastructure.Tests/Services/OAuthAuthorizationStoreTests.cs
index dde73a52..1ff3a0fc 100644
--- a/tests/Orbit.Infrastructure.Tests/Services/OAuthAuthorizationStoreTests.cs
+++ b/tests/Orbit.Infrastructure.Tests/Services/OAuthAuthorizationStoreTests.cs
@@ -171,4 +171,31 @@ public void ExchangeCode_StoresCompleteRedirectUri()
         entry.Should().NotBeNull();
         entry!.RedirectUri.Should().Be(fullUrl);
     }
+
+    [Fact]
+    public void ExchangeCode_BindsNonceToCode_AndReturnsItVerbatim()
+    {
+        var (verifier, challenge) = GeneratePkce();
+        var redirectUri = "https://claude.ai/callback";
+        var nonce = "client-nonce-" + Guid.NewGuid().ToString("N");
+
+        var code = _store.CreateCode(Guid.NewGuid(), challenge, redirectUri, "client", nonce);
+        var entry = _store.ExchangeCode(code, verifier, redirectUri);
+
+        entry.Should().NotBeNull();
+        entry!.Nonce.Should().Be(nonce);
+    }
+
+    [Fact]
+    public void ExchangeCode_WithoutNonce_LeavesNonceNull()
+    {
+        var (verifier, challenge) = GeneratePkce();
+        var redirectUri = "https://claude.ai/callback";
+
+        var code = _store.CreateCode(Guid.NewGuid(), challenge, redirectUri, "client");
+        var entry = _store.ExchangeCode(code, verifier, redirectUri);
+
+        entry.Should().NotBeNull();
+        entry!.Nonce.Should().BeNull();
+    }
 }