diff --git a/zerver/migrations/0751_externalauthid_zerver_user_externalauth_uniq.py b/zerver/migrations/0751_externalauthid_zerver_user_externalauth_uniq.py
new file mode 100644
index 0000000000..c91fd18c0a
--- /dev/null
+++ b/zerver/migrations/0751_externalauthid_zerver_user_externalauth_uniq.py
@@ -0,0 +1,18 @@
+# Generated by Django 5.2.4 on 2025-08-12 18:15
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("zerver", "0750_multiuseinvite_welcome_message_custom_text_and_more"),
+    ]
+
+    operations = [
+        migrations.AddConstraint(
+            model_name="externalauthid",
+            constraint=models.UniqueConstraint(
+                fields=("user", "external_auth_method_name"), name="zerver_user_externalauth_uniq"
+            ),
+        ),
+    ]
diff --git a/zerver/models/users.py b/zerver/models/users.py
index afd2ab8d96..b635c4081f 100644
--- a/zerver/models/users.py
+++ b/zerver/models/users.py
@@ -1265,4 +1265,13 @@ class ExternalAuthID(models.Model):
                 ],
                 name="zerver_externalauthid_uniq",
             ),
+            # Each user should only have at most a single ExternalAuthID
+            # for any authentication method.
+            models.UniqueConstraint(
+                fields=[
+                    "user",
+                    "external_auth_method_name",
+                ],
+                name="zerver_user_externalauth_uniq",
+            ),
         ]