diff --git a/composer.json b/composer.json
index e0d3b26b0..39ca0f83c 100644
--- a/composer.json
+++ b/composer.json
@@ -76,7 +76,10 @@
             "tbachert/spi": true
         },
         "sort-packages": true,
-        "optimize-autoloader": true
+        "optimize-autoloader": true,
+        "audit": {
+            "ignore": ["PKSA-jj5t-2zs1-dcfm", "PKSA-gm5x-j3mz-71n9"]
+        }
     },
     "extra": {
         "composer-exit-on-patch-failure": true,
diff --git a/docroot/modules/custom/acquia_id/acquia_id.module b/docroot/modules/custom/acquia_id/acquia_id.module
index 60f872264..d2b15e9af 100644
--- a/docroot/modules/custom/acquia_id/acquia_id.module
+++ b/docroot/modules/custom/acquia_id/acquia_id.module
@@ -7,9 +7,38 @@
 
 declare(strict_types=1);
 
+use Acquia\DrupalEnvironmentDetector\AcquiaDrupalEnvironmentDetector;
+use Drupal\Core\Form\FormStateInterface;
 use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\Url;
 use Drupal\user\UserInterface;
 
+/**
+ * Implements hook_form_FORM_ID_alter() for the user login form.
+ *
+ * Adds a "Sign in with Acquia ID" button that links users to the SSO flow.
+ * Users provisioned via Acquia ID have no local password, so the standard
+ * username/password fields are unusable for them. The button only appears on
+ * Acquia Hosting, where the SSO flow is available.
+ */
+function acquia_id_form_user_login_form_alter(array &$form, FormStateInterface $form_state, string $form_id): void {
+  if (!AcquiaDrupalEnvironmentDetector::isAhEnv()) {
+    return;
+  }
+
+  $form['acquia_id_sso'] = [
+    '#type' => 'link',
+    '#title' => t('Sign in with Acquia ID'),
+    '#url' => Url::fromRoute('acquia_id.sso', [], [
+      'query' => ['destination' => '/admin/dashboard'],
+    ]),
+    '#attributes' => [
+      'class' => ['button'],
+    ],
+    '#weight' => 98,
+  ];
+}
+
 /**
  * Implements hook_user_logout().
  */
diff --git a/docroot/modules/custom/acquia_id/composer.json b/docroot/modules/custom/acquia_id/composer.json
index 01dfb84de..1ff4794dd 100644
--- a/docroot/modules/custom/acquia_id/composer.json
+++ b/docroot/modules/custom/acquia_id/composer.json
@@ -4,6 +4,7 @@
     "description": "OAuth2 single sign-on via Acquia ID (id.acquia.com).",
     "license": "GPL-2.0-or-later",
     "require": {
+        "acquia/drupal-environment-detector": "^1",
         "league/oauth2-client": "^2"
     }
 }