diff --git a/src/Controller/Security/OAuth2Controller.php b/src/Controller/Security/OAuth2Controller.php
index b44e520..07aa543 100644
--- a/src/Controller/Security/OAuth2Controller.php
+++ b/src/Controller/Security/OAuth2Controller.php
@@ -3,6 +3,7 @@
 namespace App\Controller\Security;
 
 use App\Security\OAuth2\MyEpClient;
+use Flagception\Manager\FeatureManagerInterface;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -10,13 +11,17 @@ use Symfony\Component\Routing\Attribute\Route;
 
 class OAuth2Controller extends AbstractController
 {
-    public function __construct(private readonly MyEpClient $client)
-    {
+    public function __construct(
+        private readonly MyEpClient $client,
+        private readonly FeatureManagerInterface $featureManager,
+    ) {
     }
 
     #[Route('/myep-auth/init', name: 'app_myep_auth_init')]
     public function init(Request $request): Response
     {
+        $this->denyUnlessFeatureIsActive();
+
         $provider = $this->client->getProvider();
         $url = $provider->getAuthorizationUrl();
         $state = $provider->getState();
@@ -28,5 +33,19 @@ class OAuth2Controller extends AbstractController
     #[Route('/myep-auth/check', name: 'app_myep_auth_check')]
     public function check(): void
     {
+        // only reached when the authenticator did not handle the request, which with the
+        // feature switched off it never does
+        $this->denyUnlessFeatureIsActive();
+    }
+
+    /**
+     * The login is not merely hidden while the feature is off: the callback creates and
+     * updates local accounts, so the routes must not be reachable by direct URL either.
+     */
+    private function denyUnlessFeatureIsActive(): void
+    {
+        if (false === $this->featureManager->isActive('myep_login')) {
+            throw $this->createNotFoundException();
+        }
     }
 }