diff --git a/pkg/auth/oauth.go b/pkg/auth/oauth.go
index c03c30d10d..8591e85ba0 100644
--- a/pkg/auth/oauth.go
+++ b/pkg/auth/oauth.go
@@ -444,7 +444,7 @@ func RefreshAccessToken(cred *AuthCredential, cfg OAuthProviderConfig) (*AuthCre
 		"client_id":     {cfg.ClientID},
 		"grant_type":    {"refresh_token"},
 		"refresh_token": {cred.RefreshToken},
-		"scope":         {"openid profile email"},
+		"scope":         {cfg.Scopes},
 	}
 	if cfg.ClientSecret != "" {
 		data.Set("client_secret", cfg.ClientSecret)
diff --git a/pkg/auth/oauth_test.go b/pkg/auth/oauth_test.go
index b318934f97..5c4e95a37a 100644
--- a/pkg/auth/oauth_test.go
+++ b/pkg/auth/oauth_test.go
@@ -231,6 +231,8 @@ func TestExchangeCodeForTokens(t *testing.T) {
 }
 
 func TestRefreshAccessToken(t *testing.T) {
+	expectedScope := "https://www.googleapis.com/auth/cloud-platform custom-scope"
+
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/oauth/token" {
 			http.Error(w, "not found", http.StatusNotFound)
@@ -243,6 +245,10 @@ func TestRefreshAccessToken(t *testing.T) {
 			return
 		}
 
+		if gotScope := r.FormValue("scope"); gotScope != expectedScope {
+			t.Errorf("Server received scope = %q, want %q", gotScope, expectedScope)
+		}
+
 		resp := map[string]any{
 			"access_token":  "refreshed-access-token",
 			"refresh_token": "refreshed-refresh-token",
@@ -255,6 +261,7 @@ func TestRefreshAccessToken(t *testing.T) {
 	cfg := OAuthProviderConfig{
 		Issuer:   server.URL,
 		ClientID: "test-client",
+		Scopes:   expectedScope,
 	}
 
 	cred := &AuthCredential{