diff --git a/apps/api/src/auth/oauth-pages.test.ts b/apps/api/src/auth/oauth-pages.test.ts
index b40dd54..38fcbb8 100644
--- a/apps/api/src/auth/oauth-pages.test.ts
+++ b/apps/api/src/auth/oauth-pages.test.ts
@@ -63,6 +63,13 @@ describe("FrontLit OAuth pages", () => {
     expect(response.headers.get("x-frame-options")).toBe("DENY");
   });
 
+  it("brands the hosted login with the FrontLit logo, favicon, and color", async () => {
+    const response = await request("/login?redirect=http://localhost:3000/pages/foo");
+    expect(response.body).toContain('src="http://localhost:3000/icon.svg"');
+    expect(response.body).toContain('href="http://localhost:3000/icon.svg"');
+    expect(response.body).toContain("html{--brand-primary:oklch(0.47 0.14 230)}");
+  });
+
   it("no longer serves an OAuth team picker", async () => {
     const response = await request("/oauth/select-team?client_id=abc");
     expect(response.status).toBe(404);
diff --git a/apps/api/src/auth/oauth-pages.ts b/apps/api/src/auth/oauth-pages.ts
index 7c7cf4a..23abda9 100644
--- a/apps/api/src/auth/oauth-pages.ts
+++ b/apps/api/src/auth/oauth-pages.ts
@@ -10,6 +10,9 @@ router.use(
     authBasePath,
     allowedRedirectOrigins: [webClientUrl],
     defaultRedirectUrl: new URL("/", webClientUrl).toString(),
+    logoUrl: new URL("/icon.svg", webClientUrl).toString(),
+    faviconUrl: new URL("/icon.svg", webClientUrl).toString(),
+    primaryColor: "oklch(0.47 0.14 230)",
     loginMethods: hostedLoginMethods,
     legacyHostOnlySessionCookieNames: process.env.AUTH_COOKIE_DOMAIN
       ? [