diff --git a/src/oauth.rs b/src/oauth.rs
index a337b45..fb1d84f 100644
--- a/src/oauth.rs
+++ b/src/oauth.rs
@@ -252,7 +252,15 @@ pub mod metadata {
     ///
     /// [oidc-discovery-1]: https://openid.net/specs/openid-connect-discovery-1_0.html
     pub fn oidc_discovery_uri(base_url: &Url) -> color_eyre::Result<Url> {
-        Ok(base_url.join(".well-known/openid-configuration")?)
+        const WELL_KNOWN: &str = ".well-known/openid-configuration";
+        // avoid the footgun in Url::join (trailing slash is significant, per [`Url::join`] docs)
+        if base_url.path().ends_with('/') {
+            Ok(base_url.join(WELL_KNOWN)?)
+        } else {
+            let mut base_url = base_url.clone();
+            base_url.set_path(&format!("{}/{}", base_url.path(), WELL_KNOWN));
+            Ok(base_url)
+        }
     }
 }