diff --git a/.changeset/optional-auth-domain.md b/.changeset/optional-auth-domain.md
new file mode 100644
index 0000000..29ad60a
--- /dev/null
+++ b/.changeset/optional-auth-domain.md
@@ -0,0 +1,19 @@
+---
+"create-eigen-game": patch
+---
+
+Scaffold an optional `AUTH_DOMAIN`.
+
+Web sign-in runs through Firebase's popup, which loads
+`https://<authDomain>/__/auth/handler`, so Google's account chooser reads "Sign
+in to continue to my-project.firebaseapp.com". `app-config.json` now carries an
+`AUTH_DOMAIN` key and `main.dart` passes it to `EngineConfig.authDomain`. The
+pinned `eigen_flutter` floor moves to `^0.4.1` for that parameter: additive, so
+a patch pre-1.0, but the floor has to rise or a scaffold could resolve 0.4.0 and
+fail to compile.
+
+Empty is the scaffolded value and the right answer for almost every game: it
+leaves sign-in on the Firebase project's own domain, which works everywhere and
+needs no Firebase Hosting. Setting it is cosmetic and web-only, and it is not
+`APP_HOST`: the value must be a Firebase Hosting domain, a sibling of the
+Worker's host rather than the host itself.
diff --git a/packages/create-eigen-game/src/index.ts b/packages/create-eigen-game/src/index.ts
index 0a6d153..a9863d4 100644
--- a/packages/create-eigen-game/src/index.ts
+++ b/packages/create-eigen-game/src/index.ts
@@ -207,8 +207,14 @@ const engineVersion = engineRange((JSON.parse(readFileSync(resolve(packageRoot,
  * every 0.3.x pins `eigen_api: ^0.2.0`, which cannot read a 0.3.x engine at all.
  * A scaffold pinning 0.3.x would therefore resolve, compile, and then fail to
  * render a game, which is the worst of the three.
+ *
+ * Raised to 0.4.1 for `EngineConfig.authDomain`, which the generated
+ * `main.dart` passes. Additive, so pre-1.0 it is a patch and `^0.4.0` would
+ * still resolve it, but `^0.4.0` also still resolves 0.4.0, where the parameter
+ * does not exist and the scaffold would not compile. The floor is what makes
+ * the generated code and the installed shell agree.
  */
-const flutterClientVersion = "^0.4.0";
+const flutterClientVersion = "^0.4.1";
 
 const gameSlug = (value: string): string => {
   if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value)) {
diff --git a/packages/create-eigen-game/templates/app-overlay/app-config.json.template b/packages/create-eigen-game/templates/app-overlay/app-config.json.template
index 672a823..6e7a3f6 100644
--- a/packages/create-eigen-game/templates/app-overlay/app-config.json.template
+++ b/packages/create-eigen-game/templates/app-overlay/app-config.json.template
@@ -1,6 +1,7 @@
 {
   "API_BASE_URL": "http://localhost:8787",
   "APP_HOST": "",
+  "AUTH_DOMAIN": "",
   "GOOGLE_WEB_CLIENT_ID": "",
   "FIREBASE_VAPID_KEY": ""
 }
diff --git a/packages/create-eigen-game/templates/app-overlay/lib/main.dart.template b/packages/create-eigen-game/templates/app-overlay/lib/main.dart.template
index 554b720..8c9e4b0 100644
--- a/packages/create-eigen-game/templates/app-overlay/lib/main.dart.template
+++ b/packages/create-eigen-game/templates/app-overlay/lib/main.dart.template
@@ -9,6 +9,11 @@ const _apiBaseUrl = String.fromEnvironment('API_BASE_URL');
 const _googleWebClientId = String.fromEnvironment('GOOGLE_WEB_CLIENT_ID');
 const _firebaseVapidKey = String.fromEnvironment('FIREBASE_VAPID_KEY');
 const _appHost = String.fromEnvironment('APP_HOST');
+// Optional, and empty is the normal answer. Sign-in works without it; setting
+// it only changes the hostname Google's account chooser shows a web player,
+// and it requires a Firebase Hosting domain, which is not APP_HOST:
+// https://eigeninteractive.com/docs/ship-it/deploy-the-web-app
+const _authDomain = String.fromEnvironment('AUTH_DOMAIN');
 
 Future<void> main() async {
   await runEngineApp(
@@ -28,6 +33,7 @@ Future<void> main() async {
         apiBaseUrl: _apiBaseUrl,
         googleWebClientId: _googleWebClientId,
         appHost: _appHost.isEmpty ? null : _appHost,
+        authDomain: _authDomain.isEmpty ? null : _authDomain,
         firebaseVapidKey: _firebaseVapidKey,
       ),
     ),
diff --git a/packages/create-eigen-game/test/scaffold.spec.ts b/packages/create-eigen-game/test/scaffold.spec.ts
index caeff09..ec20934 100644
--- a/packages/create-eigen-game/test/scaffold.spec.ts
+++ b/packages/create-eigen-game/test/scaffold.spec.ts
@@ -195,7 +195,7 @@ describe("scaffoldGame", () => {
     // release on that line, which is the part a scaffold-time pub.dev lookup
     // was duplicating. Crossing to the next line is the move that needs the
     // `scaffold` CI job to confirm the templates still compile.
-    expect(run).toHaveBeenCalledWith("flutter", ["pub", "add", "eigen_flutter@^0.4.0", "firebase_core@^4.9.0", "firebase_messaging@^16.2.2"], expect.stringMatching(/\/app$/));
+    expect(run).toHaveBeenCalledWith("flutter", ["pub", "add", "eigen_flutter@^0.4.1", "firebase_core@^4.9.0", "firebase_messaging@^16.2.2"], expect.stringMatching(/\/app$/));
     // A separate `pub add` (rather than folded into the call above) so a
     // failure here is legible on its own, and because these are dev
     // dependencies (`dev:` prefix) while the engine/Firebase packages above