diff --git a/onyxia-api/src/main/java/fr/insee/onyxia/api/security/OIDCConfiguration.java b/onyxia-api/src/main/java/fr/insee/onyxia/api/security/OIDCConfiguration.java
index 205f8dd6..78070378 100644
--- a/onyxia-api/src/main/java/fr/insee/onyxia/api/security/OIDCConfiguration.java
+++ b/onyxia-api/src/main/java/fr/insee/onyxia/api/security/OIDCConfiguration.java
@@ -168,6 +168,10 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                         httpSecurityOAuth2ResourceServerConfigurer -> {
                             httpSecurityOAuth2ResourceServerConfigurer.jwt(
                                     Customizer.withDefaults());
+                            // Spring Security 7 no longer enables DPoP automatically (it did in
+                            // 6.5): Onyxia web sends DPoP-bound tokens ("Authorization: DPoP")
+                            httpSecurityOAuth2ResourceServerConfigurer.dPoP(
+                                    Customizer.withDefaults());
                         });
         return http.build();
     }