diff --git a/packages/auth/src/auth.ts b/packages/auth/src/auth.ts
index 9bb79565a..9b41f31f8 100644
--- a/packages/auth/src/auth.ts
+++ b/packages/auth/src/auth.ts
@@ -41,7 +41,9 @@ if (env.google) {
 
 		accessType: "offline",
 
-		...(primaryWorkspaceDomain() ? { hd: primaryWorkspaceDomain() } : {}),
+		...(!env.googleDisableHd && primaryWorkspaceDomain()
+			? { hd: primaryWorkspaceDomain() }
+			: {}),
 	};
 }
 
@@ -72,7 +74,7 @@ export const auth = betterAuth({
 	}),
 
 	emailAndPassword: {
-		enabled: false,
+		enabled: env.emailAndPasswordEnabled,
 	},
 
 	socialProviders,
diff --git a/packages/auth/src/env.ts b/packages/auth/src/env.ts
index 9813d7a44..d039f0dc8 100644
--- a/packages/auth/src/env.ts
+++ b/packages/auth/src/env.ts
@@ -9,6 +9,11 @@ const optional = (key: string): string | undefined => {
 	return value && value.length > 0 ? value : undefined;
 };
 
+const flag = (key: string): boolean => {
+	const value = optional(key)?.toLowerCase();
+	return value === "true" || value === "1";
+};
+
 const pair = (
 	idKey: string,
 	secretKey: string,
@@ -65,6 +70,10 @@ export const env = {
 	cookieDomain: optional("AUTH_COOKIE_DOMAIN"),
 	trustedOrigins: [...new Set([...appUrls, apiUrl])],
 	isProduction: process.env.NODE_ENV === "production",
+	/** Opt-in: set EMAIL_PASSWORD_ENABLED=true on a deploy to allow email/password auth. */
+	emailAndPasswordEnabled: flag("EMAIL_PASSWORD_ENABLED"),
+	/** Opt-in: set GOOGLE_DISABLE_HD=true to omit Google hosted-domain restriction. */
+	googleDisableHd: flag("GOOGLE_DISABLE_HD"),
 } as const;
 
 export function isGoogleConfigured(): boolean {