diff --git a/app/models/user.rb b/app/models/user.rb
index e3297e0e9..4515d33d7 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -530,7 +530,10 @@ class User < ApplicationRecord
   end
 
   def authenticated_with_all_providers?
-    identities_enabled.pluck(:provider).map(&:to_sym) == Authentication::Providers.enabled
+    # ga_providers refers to Generally Available (not in beta)
+    ga_providers = Authentication::Providers.enabled.reject { |sym| sym == :apple }
+    enabled_providers = identities.pluck(:provider).map(&:to_sym)
+    (ga_providers - enabled_providers).empty?
   end
 
   def rate_limiter
diff --git a/app/services/broadcasts/welcome_notification/generator.rb b/app/services/broadcasts/welcome_notification/generator.rb
index 8838716d7..e9705f71f 100644
--- a/app/services/broadcasts/welcome_notification/generator.rb
+++ b/app/services/broadcasts/welcome_notification/generator.rb
@@ -92,7 +92,10 @@ module Broadcasts
       end
 
       def authenticated_with_all_providers?
-        identities.count == Authentication::Providers.enabled.size
+        # ga_providers refers to Generally Available (not in beta)
+        ga_providers = Authentication::Providers.enabled.reject { |sym| sym == :apple }
+        enabled_providers = identities.pluck(:provider).map(&:to_sym)
+        (ga_providers - enabled_providers).empty?
       end
 
       def user_is_following_tags?
diff --git a/app/views/users/_additional_authentication.html.erb b/app/views/users/_additional_authentication.html.erb
index 8ddb85e1b..2cf1a00f9 100644
--- a/app/views/users/_additional_authentication.html.erb
+++ b/app/views/users/_additional_authentication.html.erb
@@ -1,7 +1,13 @@
 <% unless @user.authenticated_with_all_providers? %>
   <div class="crayons-card crayons-card--content-rows block">
     <% authentication_enabled_providers.each do |provider| %>
-      <% next if provider.provider_name == :apple && !Flipper.enabled?(:apple_auth) %>
+      <!--
+        TODO: [@forem/oss] Only until we refactor our cookie configurations
+        we'll be able to connect existing accounts with SIWA. This should be
+        done when Apple Auth Provider is no longer in 'Beta':
+        https://github.com/forem/forem/pull/12114
+      -->
+      <% next if provider.provider_name == :apple %>
       <% unless @user.authenticated_through?(provider.provider_name) %>
         <%= form_with url: provider.sign_in_path(state: "profile"), class: "flex w-100", local: true do |f| %>
           <%= f.button type: :submit, class: "crayons-btn crayons-btn--icon-left crayons-btn--brand-#{provider.provider_name} m-1" do %>
diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
index deac47fcc..b17b928f3 100644
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@@ -19,7 +19,7 @@ APPLE_OMNIAUTH_SETUP = lambda do |env|
   env["omniauth.strategy"].options[:client_id] = SiteConfig.apple_client_id
   env["omniauth.strategy"].options[:scope] = "email name"
   env["omniauth.strategy"].options[:key_id] = SiteConfig.apple_key_id
-  env["omniauth.strategy"].options[:pem] = SiteConfig.apple_pem
+  env["omniauth.strategy"].options[:pem] = SiteConfig.apple_pem.to_s.gsub("\\n", "\n")
   env["omniauth.strategy"].options[:provider_ignores_state] = true
   env["omniauth.strategy"].options[:team_id] = SiteConfig.apple_team_id
 end
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index f20317897..8f6855888 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -913,7 +913,7 @@ RSpec.describe User, type: :model do
   end
 
   describe "#authenticated_with_all_providers?" do
-    let(:provider) { Authentication::Providers.available.first }
+    let(:provider) { (Authentication::Providers.available - [:apple]).first }
 
     it "returns false if the user has no related identity" do
       expect(user.authenticated_with_all_providers?).to be(false)