diff --git a/.gitea/workflows/deploy-staging.yml b/.gitea/workflows/deploy-staging.yml
index 8ea5639..001ee51 100644
--- a/.gitea/workflows/deploy-staging.yml
+++ b/.gitea/workflows/deploy-staging.yml
@@ -65,6 +65,7 @@ jobs:
           SSO_TOKEN_ENDPOINT: ${{ vars.SSO_TOKEN_ENDPOINT }}
           SSO_USERINFO_ENDPOINT: ${{ vars.SSO_USERINFO_ENDPOINT }}
           SSO_SCOPE: ${{ vars.SSO_SCOPE }}
+          SSO_DEBUG_USERINFO: ${{ vars.SSO_DEBUG_USERINFO }}
           SSO_CLIENT_ID_VAR: ${{ vars.SSO_CLIENT_ID }}
           SSO_CLIENT_ID_SECRET: ${{ secrets.SSO_CLIENT_ID }}
           SUPPORT_TENANT_ID: ${{ vars.SUPPORT_TENANT_ID }}
@@ -88,6 +89,7 @@ jobs:
           sso_token_endpoint="${SSO_TOKEN_ENDPOINT:-https://sso.hmac.kr/oidc/oauth2/token}"
           sso_userinfo_endpoint="${SSO_USERINFO_ENDPOINT:-https://sso.hmac.kr/oidc/userinfo}"
           sso_scope="${SSO_SCOPE:-openid profile email tenants}"
+          sso_debug_userinfo="${SSO_DEBUG_USERINFO:-false}"
           sso_client_id="${SSO_CLIENT_ID_SECRET:-${SSO_CLIENT_ID_VAR:-}}"
           sso_client_secret="$SSO_CLIENT_SECRET"
           jwt_secret="$JWT_SECRET"
@@ -148,6 +150,7 @@ jobs:
           sso_token_endpoint_b64="$(base64_value "$sso_token_endpoint")"
           sso_userinfo_endpoint_b64="$(base64_value "$sso_userinfo_endpoint")"
           sso_scope_b64="$(base64_value "$sso_scope")"
+          sso_debug_userinfo_b64="$(base64_value "$sso_debug_userinfo")"
           sso_client_id_b64="$(base64_value "$sso_client_id")"
           sso_client_secret_b64="$(base64_value "$sso_client_secret")"
           jwt_secret_b64="$(base64_value "$jwt_secret")"
@@ -172,6 +175,7 @@ jobs:
           export SSO_TOKEN_ENDPOINT="\$(printf '%s' '$sso_token_endpoint_b64' | base64 -d)"
           export SSO_USERINFO_ENDPOINT="\$(printf '%s' '$sso_userinfo_endpoint_b64' | base64 -d)"
           export SSO_SCOPE="\$(printf '%s' '$sso_scope_b64' | base64 -d)"
+          export SSO_DEBUG_USERINFO="\$(printf '%s' '$sso_debug_userinfo_b64' | base64 -d)"
           export SSO_CLIENT_ID="\$(printf '%s' '$sso_client_id_b64' | base64 -d)"
           export SSO_CLIENT_SECRET="\$(printf '%s' '$sso_client_secret_b64' | base64 -d)"
           export JWT_SECRET="\$(printf '%s' '$jwt_secret_b64' | base64 -d)"
diff --git a/apps/web/src/server/local-sso.ts b/apps/web/src/server/local-sso.ts
index 7df0408..94d3947 100644
--- a/apps/web/src/server/local-sso.ts
+++ b/apps/web/src/server/local-sso.ts
@@ -409,6 +409,7 @@ export const getSsoDebugInfo = async (req: NextApiRequest) => {
         tenant: userInfo.tenant ?? null,
         joinedTenants: Array.isArray(userInfo.joinedTenants) ? userInfo.joinedTenants : [],
       },
+      tenantIds: asStringArray(userInfo.tenant_ids ?? userInfo.tenantIds),
       user: {
         id: asString(userInfo.id) ?? asString(userInfo.sub) ?? asString(userInfo.user_id),
         name: asString(userInfo.name),