diff --git a/internal/federationdomain/oidc/oidc.go b/internal/federationdomain/oidc/oidc.go
index 2f5c8941..e85b70d6 100644
--- a/internal/federationdomain/oidc/oidc.go
+++ b/internal/federationdomain/oidc/oidc.go
@@ -144,7 +144,10 @@ func FositeOauth2Helper(
 		RefreshTokenLifespan:  timeoutsConfiguration.RefreshTokenLifespan,
 
 		ScopeStrategy: fosite.ExactScopeStrategy,
-		EnforcePKCE:   true,
+		// The only public client is pinniped-cli, so this combination of PKCE settings requires PKCE for the
+		// pinniped-cli client and does not require PKCE for any dynamically configured OIDCClients.
+		EnforcePKCE:                 false,
+		EnforcePKCEForPublicClients: true,
 
 		// "offline_access" as per https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
 		RefreshTokenScopes: []string{oidcapi.ScopeOfflineAccess},