diff --git a/book/src/integrations/oauth2/examples.md b/book/src/integrations/oauth2/examples.md
index b5b03bc5e..dd589e9a4 100644
--- a/book/src/integrations/oauth2/examples.md
+++ b/book/src/integrations/oauth2/examples.md
@@ -156,6 +156,246 @@ To set up a self-managed GitLab instance to authenticate with Kanidm:
Once GitLab is up and running, you should now see a "Kanidm" option on your
GitLab sign-in page below the normal login form.
+## JetBrains Hub and YouTrack
+
+> These instructions were tested with the on-prem version of JetBrains YouTrack
+> 2024.3.44799 and its built-in Hub.
+
+[JetBrains Hub](https://www.jetbrains.com/hub/) is an authentication and
+authorisation system for TeamCity and YouTrack, which also provides a "single
+pane of glass" view of those applications.
+
+TeamCity is a CI/CD tool, and YouTrack is a project and issue management tool.
+
+The on-prem version of YouTrack comes with a built-in version of Hub, which it
+uses for all authentication.
+
+[JetBrains Hub supports OAuth2](https://www.jetbrains.com/help/hub/oauth2-authentication-module.html),
+but has some limitations:
+
+* JetBrains Hub's OAuth2 Auth Module does not support PKCE (as a client),
+ [which is a security issue][pkce-disable-security].
+
+* JetBrains Hub does not automatically update profile attributes after account
+ creation.
+
+ However, users can update their own profile manually.
+
+* JetBrains Hub does not support using an auto-configuration URL, which means
+ you have to set a lot of options manually (which this guide will describe).
+
+To set up YouTrack (with its built-in JetBrains Hub) to authenticate with Kanidm
+using OAuth2:
+
+1. Add an email address to your regular Kanidm account, if it doesn't have one
+ already:
+
+ ```sh
+ kanidm person update your_username -m your_username@example.com
+ ```
+
+2. Create a new Kanidm group for your YouTrack users (`youtrack_users`), and
+ add your regular account to it:
+
+ ```sh
+ kanidm group create youtrack_users
+ kanidm group add-members youtrack_users your_username
+ ```
+
+3. Create a new OAuth2 application configuration in Kanidm (`youtrack`),
+ disable the PKCE requirement ([this is insecure][pkce-disable-security], but
+ YouTrack doesn't support it), and scope access to the `youtrack_users` group:
+
+ ```sh
+ kanidm system oauth2 create youtrack YouTrack https://youtrack.example.com
+ kanidm system oauth2 warning-insecure-client-disable-pkce youtrack
+ kanidm system oauth2 update-scope-map gitlab gitlab_users email openid profile groups
+ ```
+
+4. **(optional)** By default, Kanidm presents the account's full SPN (eg:
+ `your_username@kanidm.example.com`) as its "preferred username".
+
+ You can set `youtrack` to use a short username (eg: `your_username`) with:
+
+ ```sh
+ kanidm system oauth2 prefer-short-username youtrack
+ ```
+
+5. Log in to YouTrack with an account that has full system administrator
+ rights.
+
+6. Open the Auth Modules configuration in YouTrack
+ (⚙️ Administration → Access Management → Auth
+ Modules)
+
+7. Click New module → OAuth2, and enter the following
+ details:
+
+ * Name: `Kanidm`
+ * Authorization URL: `https://kanidm.example.com/ui/oauth2`
+
+ Click Create, and you'll be taken to the Auth Module's settings page.
+
+8. Copy the Redirect URI from YouTrack and set it in Kanidm:
+
+ ```sh
+ kanidm system oauth2 add-redirect-url youtrack https://youtrack.example.com/hub/...
+ ```
+
+9. Configure the Kanidm Auth Module as follows:
+
+
+
+ - Button image
+
+ -
+
+ Upload a Kanidm or other organisational logo.
+
+ This will appear on the login form (with no text) to prompt users to sign
+ in.
+
+ By default, this is the OAuth2 logo.
+
+
+
+ - Client ID
+
+ -
+
+ `youtrack`
+
+
+
+ - Client secret
+
+ -
+
+ Copy the secret from the output of this command:
+
+ ```sh
+ kanidm system oauth2 show-basic-secret youtrack
+ ```
+
+
+
+ - Extension grant
+
+ -
+
+ _Leave blank_
+
+
+
+ - Authorization Service Endpoints
+
+
+ - Authorization URL
+
+ -
+
+ `https://kanidm.example.com/ui/oauth2`
+
+
+
+ - Token endpoint URL
+
+ -
+
+ `https://kanidm.example.com/oauth2/token`
+
+
+
+ - User data endpoint URL
+
+ -
+
+ `https://kanidm.example.com/oauth2/openid/youtrack/userinfo`
+
+
+
+ - Email endpoint URL
+
+ -
+
+ _Leave blank_
+
+
+
+ - Avatar endpoint URL
+
+ -
+
+ _Leave blank_
+
+
+
+ - Field mapping
+
+
+ - User ID
+
+ -
+
+ `sub`
+
+
+
+ - Username
+
+ -
+
+ `preferred_username`
+
+
+
+ - Full name
+
+ -
+
+ `name`
+
+
+
+ - Email
+
+ -
+
+ `email`
+
+
+
+ - Additional settings
+
+
+ - Scope
+
+ -
+
+ `openid,profile,email`
+
+
+
+ - User creation
+
+ - Enabled
+
+
+
+10. Click Save at the bottom of the page.
+
+11. Click Enable module at the top of the page.
+
+12. Click Test login... at the top of the page to try logging in with
+ Kanidm.
+
+ You may need to allow pop-ups for YouTrack in your browser for this to work.
+
+YouTrack's log in page should now have show the button image you set for Kanidm
+below the normal log in form – which you can use to log in with Kanidm.
+
+[pkce-disable-security]: ../../frequently_asked_questions.md#why-is-disabling-pkce-considered-insecure
+
## Miniflux
Miniflux is a feedreader that supports OAuth 2.0 and OpenID connect. It automatically appends the