diff --git a/Gemfile.lock b/Gemfile.lock
index 83b5f3661..b54ae3b7b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -15,6 +15,7 @@ PATH
       lodash-rails (~> 4.6.1)
       octokit (~> 4.12.0)
       omniauth-github (~> 1.3.0)
+      omniauth-rails_csrf_protection (~> 0.1.2)
       pubsubstub (~> 0.1.2)
       rails (~> 5.2.1)
       rails-timeago (~> 2.13.0)
@@ -177,6 +178,9 @@ GEM
     omniauth-oauth2 (1.6.0)
       oauth2 (~> 1.1)
       omniauth (~> 1.9)
+    omniauth-rails_csrf_protection (0.1.2)
+      actionpack (>= 4.2)
+      omniauth (>= 1.3.1)
     parallel (1.12.1)
     parser (2.5.0.2)
       ast (~> 2.4.0)
diff --git a/shipit-engine.gemspec b/shipit-engine.gemspec
index f70eb04f1..d401eeb18 100644
--- a/shipit-engine.gemspec
+++ b/shipit-engine.gemspec
@@ -29,6 +29,7 @@ Gem::Specification.new do |s|
   s.add_dependency 'lodash-rails', '~> 4.6.1'
   s.add_dependency 'octokit', '~> 4.12.0'
   s.add_dependency 'omniauth-github', '~> 1.3.0'
+  s.add_dependency 'omniauth-rails_csrf_protection', '~> 0.1.2'
   s.add_dependency 'pubsubstub', '~> 0.1.2'
   s.add_dependency 'rails', '~> 5.2.1'
   s.add_dependency 'rails-timeago', '~> 2.13.0'