diff --git a/internal/start/start.go b/internal/start/start.go
index 625a8eb00..e4bab5081 100644
--- a/internal/start/start.go
+++ b/internal/start/start.go
@@ -534,6 +534,8 @@ EOF
 		// Since signing key is validated by ResolveJWKS, simply read the key file.
 		if keys, err := afero.ReadFile(fsys, utils.Config.Auth.SigningKeysPath); err == nil && len(keys) > 0 {
 			env = append(env, "GOTRUE_JWT_KEYS="+string(keys))
+			// TODO: deprecate HS256 when it's no longer supported
+			env = append(env, "GOTRUE_JWT_VALID_METHODS=HS256,RS256,ES256")
 		}
 
 		if utils.Config.Auth.Email.Smtp != nil && utils.Config.Auth.Email.Smtp.Enabled {