diff --git a/github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/GitHubLogin.java b/github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/GitHubLogin.java
index d7b670d..69f94da 100644
--- a/github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/GitHubLogin.java
+++ b/github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/GitHubLogin.java
@@ -17,6 +17,7 @@
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.HashSet;
+import java.util.List;
 import java.util.SortedSet;
 import java.util.TreeSet;
 
@@ -42,6 +43,7 @@
 
 public class GitHubLogin {
   private static final Logger LOG = LoggerFactory.getLogger(GitHubLogin.class);
+  private static final List<Scope> DEFAULT_SCOPES = Arrays.asList(Scope.PUBLIC_REPO, Scope.USER_EMAIL);
   private static final int YEARS = 365;
   private static final long SCOPE_COOKIE_NEVER_EXPIRES = DAYS.toSeconds(50 * YEARS);
 
@@ -212,11 +214,14 @@
   private SortedSet<Scope> getScopes(String baseScopeKey, Scope... scopes) {
     HashSet<Scope> fullScopes =
         oAuthCookie == null ? new HashSet<Scope>(
-            config.scopes.get(baseScopeKey)) : new HashSet<Scope>(
+            scopesForKey(baseScopeKey)) : new HashSet<Scope>(
             oAuthCookie.scopes);
     fullScopes.addAll(Arrays.asList(scopes));
 
     return new TreeSet<Scope>(fullScopes);
   }
 
+  private List<Scope> scopesForKey(String baseScopeKey) {
+    return Objects.firstNonNull(config.scopes.get(baseScopeKey), DEFAULT_SCOPES);
+  }
 }