diff --git a/crates/goose/src/providers/gemini_oauth.rs b/crates/goose/src/providers/gemini_oauth.rs
index 96a80588..9dfaa9e4 100644
--- a/crates/goose/src/providers/gemini_oauth.rs
+++ b/crates/goose/src/providers/gemini_oauth.rs
@@ -303,11 +303,15 @@ struct LoadCodeAssistResponse {
     cloudaicompanion_project: Option<String>,
     current_tier: Option<TierInfo>,
     onboard_tiers: Option<Vec<TierInfo>>,
+    allowed_tiers: Option<Vec<TierInfo>>,
 }
 
 #[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
 struct TierInfo {
     id: Option<String>,
+    #[serde(default)]
+    is_default: Option<bool>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -424,7 +428,15 @@ async fn setup_code_assist(access_token: &str) -> Result<String> {
         .as_ref()
         .and_then(|tiers| tiers.first())
         .and_then(|t| t.id.clone())
-        .unwrap_or_else(|| "FREE".to_string());
+        .or_else(|| {
+            load_resp
+                .allowed_tiers
+                .as_ref()
+                .and_then(|tiers| tiers.iter().find(|t| t.is_default.unwrap_or(false)))
+                .or_else(|| load_resp.allowed_tiers.as_ref().and_then(|t| t.first()))
+                .and_then(|t| t.id.clone())
+        })
+        .unwrap_or_else(|| "free-tier".to_string());
 
     tracing::info!("Onboarding user with tier: {}", tier_id);
 
diff --git a/ui/desktop/src/components/settings/providers/modal/ProviderConfigurationModal.tsx b/ui/desktop/src/components/settings/providers/modal/ProviderConfigurationModal.tsx
index 145087a3..f7caaf0a 100644
--- a/ui/desktop/src/components/settings/providers/modal/ProviderConfigurationModal.tsx
+++ b/ui/desktop/src/components/settings/providers/modal/ProviderConfigurationModal.tsx
@@ -213,9 +213,16 @@ export default function ProviderConfigurationModal({
           }
         }
       }
-      await configureProviderOauth({
+      const oauthResult = await configureProviderOauth({
         path: { name: provider.name },
       });
+      if (oauthResult.error) {
+        const err = oauthResult.error as Record<string, unknown>;
+        const errDetail = typeof oauthResult.error === 'string'
+          ? oauthResult.error
+          : (err?.message as string) ?? (err?.detail as string) ?? JSON.stringify(oauthResult.error);
+        throw new Error(errDetail);
+      }
       if (onConfigured) {
         onConfigured(provider);
       } else {