diff --git a/charts/portkey-app/docs/secret-manager-integration.md b/charts/portkey-app/docs/secret-manager-integration.md
index dfc3aad..70f12b0 100644
--- a/charts/portkey-app/docs/secret-manager-integration.md
+++ b/charts/portkey-app/docs/secret-manager-integration.md
@@ -147,6 +147,8 @@ spec:
             objectAlias: oauthRedirectURI
           - path: oauthMetadataXml
             objectAlias: oauthMetadataXml
+          - path: oauthVerifiedEmailDomains
+            objectAlias: oauthVerifiedEmailDomains
           - path: smtpHost
             objectAlias: smtpHost
           - path: smtpPort
diff --git a/charts/portkey-app/docs/sso-setup.md b/charts/portkey-app/docs/sso-setup.md
index 39b5edd..06ac130 100644
--- a/charts/portkey-app/docs/sso-setup.md
+++ b/charts/portkey-app/docs/sso-setup.md
@@ -114,6 +114,31 @@ config:
 
 ---
 
+## Verified Email Domains
+
+Domain verification from Organisation Settings relies on sending a verification email, which isn't possible in air-gapped deployments. Instead, declare your verified domains in `values.yaml`:
+
+```yaml
+config:
+  oauth:
+    enabled: true
+    # ...SAML/OIDC settings above...
+    verifiedEmailDomains:
+      - "acme.com"      # exact domain: user@acme.com
+      - "*.acme.io"     # domain and its subdomains: user@acme.io, user@eu.acme.io
+```
+
+`*.` only works on a root domain: `*.eng.acme.com` will **not** match `user@x.eng.acme.com`. List such subdomains explicitly (e.g. `x.eng.acme.com`) instead.
+
+These domains:
+
+* Are passed to the backend as the comma-separated `VERIFIED_EMAIL_DOMAINS` environment variable. This works with or without `config.existingSecretName`.
+* Can alternatively come from a secret: leave `verifiedEmailDomains` empty and add an `oauthVerifiedEmailDomains` key (e.g. `acme.com,*.acme.io`) to the chart Secret / `existingSecretName` / your secret manager. If both are set, the `values.yaml` list wins.
+* Apply to **every** organisation in the deployment, in addition to any domains verified from Organisation Settings.
+* Are accepted wherever a verified domain is required: SSO sign-in domain checks, SCIM user creation, and invited users when auto-provisioning is disabled.
+
+---
+
 **Note:**
 
 * Use only one `oauthType` (`saml` or `oidc`) in the config at a time.
diff --git a/charts/portkey-app/templates/_helpers.tpl b/charts/portkey-app/templates/_helpers.tpl
index 4687921..9abbbe2 100644
--- a/charts/portkey-app/templates/_helpers.tpl
+++ b/charts/portkey-app/templates/_helpers.tpl
@@ -372,6 +372,17 @@ Template containing common environment variables that are used by several servic
       name: {{ include "portkey.secretsName" . }}
       key: oauthMetadataXml
       optional: true
+{{- /* Plain value from values.yaml wins (works with or without existingSecretName); otherwise read the optional secret key. */}}
+- name: VERIFIED_EMAIL_DOMAINS
+{{- with .Values.config.oauth.verifiedEmailDomains }}
+  value: {{ (kindIs "slice" .) | ternary (join "," .) (toString .) | quote }}
+{{- else }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ include "portkey.secretsName" . }}
+      key: oauthVerifiedEmailDomains
+      optional: true
+{{- end }}
 {{- end }}
 {{- if .Values.config.noAuth.enabled }}
 - name: AUTH_MODE
diff --git a/charts/portkey-app/values.yaml b/charts/portkey-app/values.yaml
index 90b390b..a1bd9ae 100644
--- a/charts/portkey-app/values.yaml
+++ b/charts/portkey-app/values.yaml
@@ -102,6 +102,11 @@ config:
     oauthClientSecret: ""
     oauthRedirectURI: ""
     oauthMetadataXml: ""
+    # Email domains treated as verified for every organisation (in addition to
+    # domains verified from the UI, which needs outbound mail). Used for SSO/SCIM
+    # domain checks and invited-user provisioning. "*." also allows subdomains.
+    # e.g. ["acme.com", "*.acme.io"]
+    verifiedEmailDomains: []
 
   smtp:
     enabled: false