diff --git a/src/lib/server/auth.test.ts b/src/lib/server/auth.test.ts
new file mode 100644
index 00000000..ac7901f4
--- /dev/null
+++ b/src/lib/server/auth.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest';
+import { parseUserInput } from 'better-auth/db';
+import { auth } from './auth.js';
+
+describe('user.additionalFields.username', () => {
+  it('rejects a rewrite through the built-in update-user endpoint', () => {
+    expect(() => parseUserInput(auth.options, { username: 'someone-else' }, 'update')).toThrow(
+      /username is not allowed to be set/
+    );
+  });
+
+  it('rejects a rewrite smuggled in at sign-up', () => {
+    expect(() => parseUserInput(auth.options, { username: 'someone-else' }, 'create')).toThrow(
+      /username is not allowed to be set/
+    );
+  });
+
+  it('is still declared, so the OIDC claim can populate it', () => {
+    expect(auth.options.user?.additionalFields?.username).toMatchObject({ type: 'string' });
+  });
+});
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index 2972e467..ae1967a6 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -40,7 +40,8 @@ export const auth = betterAuth({
     additionalFields: {
       username: {
         type: 'string',
-        required: false
+        required: false,
+        input: false
       }
     }
   },