diff --git a/.changeset/hip-owls-give.md b/.changeset/hip-owls-give.md
new file mode 100644
index 00000000..25f50c2a
--- /dev/null
+++ b/.changeset/hip-owls-give.md
@@ -0,0 +1,5 @@
+---
+'@hono/oauth-providers': patch
+---
+
+ensure CSRF state returned to GitHub apps
diff --git a/packages/oauth-providers/src/providers/github/authFlow.ts b/packages/oauth-providers/src/providers/github/authFlow.ts
index 743427fe..c5fcb4d9 100644
--- a/packages/oauth-providers/src/providers/github/authFlow.ts
+++ b/packages/oauth-providers/src/providers/github/authFlow.ts
@@ -43,15 +43,15 @@ export class AuthFlow {
   redirect() {
     const url = 'https://github.com/login/oauth/authorize?'
 
-    if (this.oauthApp) {
-      const parsedScope = toQueryParams({
-        scope: this.scope,
-        state: this.state,
-      })
-      return `${url}${parsedScope}&client_id=${this.client_id}`
-    }
+    const queryParams = toQueryParams({
+      client_id: this.client_id,
+      state: this.state,
+      // For GitHub apps, the scope is configured during the app setup / creation.
+      // For OAuth apps, we need to provide the scope.
+      ...(this.oauthApp && { scope: this.scope }),
+    })
 
-    return `${url}client_id=${this.client_id}`
+    return url.concat(queryParams);
   }
 
   private async getTokenFromCode() {