diff --git a/openpilot/tools/lib/auth.py b/openpilot/tools/lib/auth.py
index 9139d8b42d..6a685e38d9 100755
--- a/openpilot/tools/lib/auth.py
+++ b/openpilot/tools/lib/auth.py
@@ -32,9 +32,6 @@ from urllib.parse import parse_qs, urlencode
 from openpilot.tools.lib.api import APIError, CommaApi, UnauthorizedError
 from openpilot.tools.lib.auth_config import set_token, get_token
 
-PORT = 3000
-
-
 class ClientRedirectServer(HTTPServer):
   query_params: dict[str, Any] = {}
 
@@ -58,7 +55,7 @@ class ClientRedirectHandler(BaseHTTPRequestHandler):
     pass  # this prevent http server from dumping messages to stdout
 
 
-def auth_redirect_link(method):
+def auth_redirect_link(method, port):
   provider_id = {
     'google': 'g',
     'apple': 'a',
@@ -67,7 +64,7 @@ def auth_redirect_link(method):
 
   params = {
     'redirect_uri': f"https://api.comma.ai/v2/auth/{provider_id}/redirect/",
-    'state': f'service,localhost:{PORT}',
+    'state': f'service,localhost:{port}',
   }
 
   if method == 'google':
@@ -98,9 +95,9 @@ def auth_redirect_link(method):
 
 
 def login(method):
-  oauth_uri = auth_redirect_link(method)
-
-  web_server = ClientRedirectServer(('localhost', PORT), ClientRedirectHandler)
+  # Let the OS select an available port to avoid colliding with other services.
+  web_server = ClientRedirectServer(('localhost', 0), ClientRedirectHandler)
+  oauth_uri = auth_redirect_link(method, web_server.server_port)
   print(f'To sign in, use your browser and navigate to {oauth_uri}')
   webbrowser.open(oauth_uri, new=2)