diff --git a/CHANGELOG.md b/CHANGELOG.md
index 51aa5aa5..642be594 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@
 
 - [#3197](https://github.com/oauth2-proxy/oauth2-proxy/pull/3197) fix: NewRemoteKeySet is not using DefaultHTTPClient (@rsrdesarrollo / @tuunit)
 - [#3292](https://github.com/oauth2-proxy/oauth2-proxy/pull/3292) chore(deps): upgrade gomod and bump to golang v1.25.5 (@tuunit)
+- [#3304](https://github.com/oauth2-proxy/oauth2-proxy/pull/3304) fix: added conditional so default is not always set and env vars are honored fixes 3303 (@pixeldrew)
 
 # V7.13.0
 
diff --git a/pkg/apis/options/providers.go b/pkg/apis/options/providers.go
index 4dd206e2..94bdb592 100644
--- a/pkg/apis/options/providers.go
+++ b/pkg/apis/options/providers.go
@@ -416,7 +416,9 @@ func (a *ADFSOptions) EnsureDefaults() {
 
 // EnsureDefaults sets any default values for GoogleOptions fields.
 func (g *GoogleOptions) EnsureDefaults() {
-	g.UseOrganizationID = ptr.To(DefaultGoogleUseOrganizationID)
+	if g.UseOrganizationID == nil {
+		g.UseOrganizationID = ptr.To(DefaultGoogleUseOrganizationID)
+	}
 
 	if g.UseApplicationDefaultCredentials == nil {
 		g.UseApplicationDefaultCredentials = ptr.To(DefaultUseApplicationDefaultCredentials)