diff --git a/modules/services/forgejo.nix b/modules/services/forgejo.nix
index 9666f89..89b1409 100644
--- a/modules/services/forgejo.nix
+++ b/modules/services/forgejo.nix
@@ -553,6 +553,13 @@ in
     # For Forgejo config: https://forgejo.org/docs/latest/admin/config-cheat-sheet
     # For cli info: https://docs.gitea.com/usage/command-line
     (mkIf (cfg.enable && cfg.sso.enable != false) {
+      assertions = [
+        {
+          assertion = cfg.ldap.enable == true;
+          message = "'shb.forgejo.ldap.enable' must be set to true and ldap configured when 'shb.forgejo.sso.enable' is true. Otherwise you will never be able to register new accounts.";
+        }
+      ];
+
       services.forgejo.settings = {
         oauth2 = {
           ENABLED = true;
diff --git a/test/services/forgejo.nix b/test/services/forgejo.nix
index ac9c843..dfab3ad 100644
--- a/test/services/forgejo.nix
+++ b/test/services/forgejo.nix
@@ -330,6 +330,7 @@ in
           basic
           shb.test.certs
           https
+          ldap
           shb.test.ldap
           (shb.test.sso config.shb.certs.certs.selfsigned.n)
           sso