diff --git a/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json b/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json
index 37ffa2837..afae3a1b6 100644
--- a/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json
+++ b/third_party/google-cloud-bigquery/.cursor-plugin/plugin.json
@@ -1,9 +1,9 @@
 {
   "name": "google-cloud-bigquery",
   "displayName": "Google Cloud BigQuery",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "minClientVersions": {
-    "cursor": "3.13.0"
+    "cursor": "3.19.0"
   },
   "description": "Explore datasets and tables and run SQL queries.",
   "author": {
@@ -32,5 +32,26 @@
     "sql",
     "mcp"
   ],
+  "variables": {
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+      "CLIENT_ID",
+      "CLIENT_SECRET"
+    ],
+    "properties": {
+      "CLIENT_ID": {
+        "type": "string",
+        "title": "Client ID",
+        "description": "A Google OAuth client your team created. Every team member signs in under it."
+      },
+      "CLIENT_SECRET": {
+        "type": "string",
+        "title": "Client secret",
+        "writeOnly": true,
+        "format": "password"
+      }
+    }
+  },
   "mcpServers": "./mcp.json"
 }
diff --git a/third_party/google-cloud-bigquery/CHANGELOG.md b/third_party/google-cloud-bigquery/CHANGELOG.md
index 1789565cd..f0d43b050 100644
--- a/third_party/google-cloud-bigquery/CHANGELOG.md
+++ b/third_party/google-cloud-bigquery/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 All notable changes to this plugin will be documented here.
 
+## 1.1.0
+
+- Added required `CLIENT_ID` and `CLIENT_SECRET` team variables. A team admin sets one Google OAuth client that every member signs in under, and the plugin no longer uses Cursor's own client. Existing installs need these set before the next connect. Requires Cursor 3.19.0 or later.
+
 ## 1.0.0 — initial release
 
 - Added the `google-cloud-bigquery` MCP server pointing at Google Cloud BigQuery's hosted Streamable HTTP endpoint (`https://bigquery.googleapis.com/mcp`).
diff --git a/third_party/google-cloud-bigquery/README.md b/third_party/google-cloud-bigquery/README.md
index bedfbfe19..c6102bbbd 100644
--- a/third_party/google-cloud-bigquery/README.md
+++ b/third_party/google-cloud-bigquery/README.md
@@ -19,13 +19,26 @@ Or run `/add-plugin google-cloud-bigquery` in chat.
   "mcpServers": {
     "google-cloud-bigquery": {
       "type": "http",
-      "url": "https://bigquery.googleapis.com/mcp"
+      "url": "https://bigquery.googleapis.com/mcp",
+      "auth": {
+        "CLIENT_ID": "${CLIENT_ID}",
+        "CLIENT_SECRET": "${CLIENT_SECRET}"
+      }
     }
   }
 }
 ```
 
-Auth is OAuth. Cursor prompts for Google Cloud BigQuery sign-in when the plugin connects — there is no client ID or personal access token to configure.
+Auth is OAuth. Cursor prompts for Google Cloud BigQuery sign-in when the plugin connects. It signs in with a Google OAuth client your team provides; see below.
+
+## Set up your team's OAuth client
+
+A team admin provides one Google OAuth client, and every member signs in under it, so consent and audit show the team's own app. The Client ID and Client secret are required.
+
+1. In the Google Cloud console, create an OAuth client for a **Web application** and add Cursor's OAuth callback URL as an authorized redirect URI. Add the `https://www.googleapis.com/auth/bigquery` scope to the project's OAuth consent screen.
+2. In the Cursor dashboard, open the team's plugin settings for **Google Cloud BigQuery** and enter the **Client ID** and **Client secret**.
+
+Members then sign in to BigQuery under that client. The secret is stored encrypted and stays on Cursor's backend; it is never sent to members' machines. Changing the client signs members out, and they reconnect once.
 
 ## Before you connect
 
diff --git a/third_party/google-cloud-bigquery/mcp.json b/third_party/google-cloud-bigquery/mcp.json
index 4068482cc..72e3884a0 100644
--- a/third_party/google-cloud-bigquery/mcp.json
+++ b/third_party/google-cloud-bigquery/mcp.json
@@ -2,7 +2,11 @@
   "mcpServers": {
     "google-cloud-bigquery": {
       "type": "http",
-      "url": "https://bigquery.googleapis.com/mcp"
+      "url": "https://bigquery.googleapis.com/mcp",
+      "auth": {
+        "CLIENT_ID": "${CLIENT_ID}",
+        "CLIENT_SECRET": "${CLIENT_SECRET}"
+      }
     }
   }
 }