diff --git a/config/caddy/Caddyfile b/config/caddy/Caddyfile
index de12a01..be61477 100644
--- a/config/caddy/Caddyfile
+++ b/config/caddy/Caddyfile
@@ -16,7 +16,7 @@ app.{DOMAIN} {
         uri /api/verify?rd=https://auth.{DOMAIN}/
 
         # Copy auth headers to upstream
-        copy_headers Remote-User Remote-Name Remote-Email
+        copy_headers Remote-User Remote-Name Remote-Email Remote-Groups
     }
 
     # Serve launcher + proxy upstream apps