diff --git a/litellm/proxy/management_endpoints/ui_sso.py b/litellm/proxy/management_endpoints/ui_sso.py
index 42999e6b15a..473dc72cc92 100644
--- a/litellm/proxy/management_endpoints/ui_sso.py
+++ b/litellm/proxy/management_endpoints/ui_sso.py
@@ -1080,7 +1080,10 @@ def _parse_generic_sso_headers(
     provider: _OIDC_PROVIDER_NAMES = _OIDC_PROVIDER_GENERIC,
 ) -> dict:
     """Parse comma-separated *_SSO_HEADERS env var into a dict."""
-    raw = os.getenv(f"{_get_oidc_env_prefix(provider)}_SSO_HEADERS", None)
+    raw = os.getenv(
+        f"{_get_oidc_env_prefix(provider)}_SSO_HEADERS",
+        os.getenv("GENERIC_SSO_HEADERS", None),
+    )
     if raw is None:
         return {}
     result: Dict[str, str] = {}
diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index 4a538a28e03..370c6020ef4 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -4008,13 +4008,26 @@ class ProxyConfig:
             ### PKCE MULTI-INSTANCE PREREQUISITE CHECK ###
             # PKCE verifiers are stored in redis_usage_cache when available so they can
             # be read back by any instance (not just the one that started the auth flow).
-            use_pkce = os.getenv("GENERIC_CLIENT_USE_PKCE", "false").lower() == "true"
+            generic_use_pkce = (
+                os.getenv("GENERIC_CLIENT_USE_PKCE", "false").lower() == "true"
+            )
+            # Okta defaults PKCE to enabled when OKTA_CLIENT_ID is configured.
+            okta_use_pkce = (
+                os.getenv("OKTA_CLIENT_ID") is not None
+                and os.getenv("OKTA_CLIENT_USE_PKCE", "true").lower() == "true"
+            )
+            use_pkce = generic_use_pkce or okta_use_pkce
             if use_pkce and redis_usage_cache is None:
                 global _pkce_no_redis_warning_emitted
                 if not _pkce_no_redis_warning_emitted:
                     _pkce_no_redis_warning_emitted = True
+                    pkce_env_var = (
+                        "GENERIC_CLIENT_USE_PKCE=true"
+                        if generic_use_pkce
+                        else "OKTA_CLIENT_USE_PKCE defaults to true when OKTA_CLIENT_ID is set"
+                    )
                     verbose_proxy_logger.warning(
-                        "GENERIC_CLIENT_USE_PKCE=true but Redis is not configured for LiteLLM caching. "
+                        f"{pkce_env_var} but Redis is not configured for LiteLLM caching. "
                         "PKCE verifiers will not be shared across instances — callbacks may land on a "
                         "different pod than the login request and fail silently. "
                         "Configure Redis via the 'cache' section in your proxy config, "