diff --git a/docs/img/management/github-new-ca.png b/docs/img/management/github-new-ca.png
new file mode 100644
index 0000000000000..34db553826e22
Binary files /dev/null and b/docs/img/management/github-new-ca.png differ
diff --git a/docs/img/management/how-it-works-github-proxy.svg b/docs/img/management/how-it-works-github-proxy.svg
new file mode 100644
index 0000000000000..0443b8b1f5dc7
--- /dev/null
+++ b/docs/img/management/how-it-works-github-proxy.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/docs/pages/admin-guides/management/guides/github-integration.mdx b/docs/pages/admin-guides/management/guides/github-integration.mdx
new file mode 100644
index 0000000000000..7191eda3c3f3d
--- /dev/null
+++ b/docs/pages/admin-guides/management/guides/github-integration.mdx
@@ -0,0 +1,144 @@
+---
+title: GitHub Integration
+description: How to use Teleport's short-lived SSH certificates with the GitHub Certificate Authority.
+---
+
+Teleport can proxy Git commands and use short-lived SSH certificate to
+authenticate GitHub organizations that trust Teleport's certificate authorities.
+
+In this guide, you will:
+- Create a GitHub OAuth application for Teleport to obtain user's GitHub
+ identities.
+- Configure SSH certificate authorities for your GitHub organizations.
+- Create Teleport resources for the GitHub integration.
+- Run Git commands through Teleport
+
+## How it works
+
+GitHub enables organizations to configure a list of SSH Certificate Authorities
+(CAs) for authentication. This feature allows access to the organization's
+repositories using short-lived SSH certificates signed by an approved
+Certificate Authority (CA), such as a Teleport CA. Additionally, organizations
+can enforce stricter security by requiring these signed SSH certificates for
+access, effectively disabling the use of personal SSH keys and access tokens.
+
+Teleport users can configure their Git repositories once to proxy through
+Teleport. After setup, Git commands automatically route through Teleport's
+backend, which impersonates their GitHub identity and uses short-lived SSH
+certificates signed by Teleport's CA for authentication with GitHub.
+
+To retrieve a user's GitHub identity, `tsh` initiates the GitHub OAuth flow by
+opening a browser window for the user to log in with their GitHub credentials.
+
+
+
+Note that Teleport proxies Git commands through SSH but the users should
+continue to access github.com regularly through their browsers.
+
+## Prerequisites
+
+- Teleport Enterprise or Teleport Enterprise Cloud cluster version 17.2 or higher.
+- Access to GitHub Enterprise and permissions to modify GitHub's SSH aertificate
+ authorities and configure OAuth applications.
+- (!docs/pages/includes/tctl.mdx!)
+- Git locally installed
+
+## Step 1/4. Configure a GitHub OAuth application
+
+The GitHub integration requires a GitHub OAuth application to obtain users'
+GitHub identities. You can skip this step if the Teleport users use GitHub SSO
+to sign in Teleport.
+
+Go to "OAuth Apps" under "Developer Settings" of your organization's settings.
+Click on "New OAuth App".
+
+Fill in the details. Use the following for "Authentication callback URL":
+```
+https:///v1/webapi/github/
+```
+
+Once the OAuth application is created, create a client secret and remember the
+client ID and the secret for the next step:
+
+
+
+## Step 2/4. Create a GitHub integration and export the CAs
+
+Now create a yaml file that represents the Github integration:
+```yaml
+# github_integration.yaml
+kind: integration
+sub_kind: github
+version: v1
+metadata:
+ name: github-
+spec:
+ github:
+ organization:
+ credentials:
+ id_secret:
+ id:
+ secret:
+```
+Replace `my-github-org` with the organization name, and replace
+`oauth-app-client-id` and `oauth-app-client-secret` with values from the
+previous step.
+
+To create the resource with `tctl`, run:
+```bash
+tctl create -f github_integration.yaml
+```
+
+Once the integration resource is created, export the CA to be used for GitHub:
+```bash
+tctl auth export --type github --integration github-
+```
+
+Now go to the "Authentication Security" page of your GitHub organization. Click
+on "New CA" under the "SSH certificate authorities" section, and copy-paste the CA
+exported from the above `tctl auth export` command.
+
+
+
+## Step 3/4. Configure access
+
+User access is granted through `git_server` resources. The `git_server`
+references the integration created in the previous step:
+```yaml
+# git_server.yaml
+kind: git_server
+sub_kind: github
+version: v2
+spec:
+ github:
+ integration: github-
+ organization:
+```
+
+To create the resource with `tctl`, run:
+```bash
+tctl create -f git_server.yaml
+```
+
+The user role must have `github_permissions` configured to allow access to your
+GitHub organization. For example:
+```yaml
+# role_with_github_permissions.yaml
+kind: role
+metadata:
+ name: github-
+spec:
+ allow:
+ github_permissions:
+ - orgs:
+ -
+version: v7
+```
+
+You can either create a new role as shown above or add github_permissions to an
+existing role. Ensure the role is assigned to the appropriate Teleport users who
+will access Git repositories through Teleport.
+
+## Step 4/4. Connect
+
+(!docs/pages/connect-your-client/includes/tsh-git.mdx!)
diff --git a/docs/pages/admin-guides/management/guides/ssh-key-extensions.mdx b/docs/pages/admin-guides/management/guides/ssh-key-extensions.mdx
deleted file mode 100644
index 0ebf4bfb96197..0000000000000
--- a/docs/pages/admin-guides/management/guides/ssh-key-extensions.mdx
+++ /dev/null
@@ -1,79 +0,0 @@
----
-title: Using Teleport's Certificate Authority with GitHub
-description: How to use Teleport's short-lived SSH certificates with the GitHub Certificate Authority.
----
-
-Teleport supports exporting user SSH certificates with configurable key extensions. This allows the Teleport CA to be used in conjunction with GitHub's support for SSH Certificate Authorities. This way, users can access their organizations' repositories with short-lived, signed SSH certificates.
-
-## Prerequisites
-
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
-
-- Access to GitHub Enterprise and permissions to modify GitHub's SSH Certificate Authorities.
-- (!docs/pages/includes/tctl.mdx!)
-
-## Step 1/3. Import the Teleport CA into GitHub
-
-In order to export the Teleport CA, execute the following command, assigning to the address of your Teleport Proxy Service:
-
-```code
-$ curl 'https:///webapi/auth/export?type=user' | sed 's/^cert-authority //g'
-```
-
-Next, follow the instructions in the guide below to import your Teleport CA into GitHub:
-
-[Managing your organization's SSH certificate authorities](https://docs.github.com/en/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities)
-
-The contents of the exported `teleport.ca` file should by pasted into the "Key" field after clicking "New CA".
-
-## Step 2/3. Configure the GitHub key extension
-
-Create or update a role to include the `cert_extensions` option. The value of `name` must be `login@github.com`.
-
-```yaml
-kind: role
-version: v5
-metadata:
- name: developer
-spec:
- options:
- cert_extensions:
- - type: ssh
- mode: extension
- name: login@github.com # required to be `login@github.com`.
- value: "{{ external.logins }}"
-```
-
-(!docs/pages/includes/add-role-to-user.mdx role="developer"!)
-
-## Step 3/3. Issue a user certificate
-
-When you authenticated to Teleport to assume the `developer` role we defined
-earlier, Teleport added the certificate extensions you configured to your user
-certificate. You can then refer to this path in your local SSH configuration.
-
-For convenience, open a terminal and assign an environment variable to the
-location of your user certificate. Replace with
-the domain name of your Teleport cluster and with the name
-of your Teleport user:
-
-```code
-$ export TELEPORT_CERT=~/.tsh/keys//-ssh/-cert.pub
-```
-
-To test that authentication with this signed certificate is working correctly, SSH into `github.com` with your organization's user:
-
-```code
-$ ssh -i $TELEPORT_CERT org-@github.com
-```
-If authentication is successful, a "You've successfully authenticated" message should be displayed in the terminal.
-
-This newly generated certificate may then be used when interacting with GitHub over SSH by adding the following to the `~/.ssh/config` file:
-
-```code
-Host github.com
- HostName github.com
- IdentityFile path/to/cert.pub
-```
-
-When using SSH Certificate Authorities, you should retrieve your GitHub repository's SSH URL from the GitHub UI so the correct SSH user is used for authentication. For more information, see [About SSH URLs with SSH certificates](https://docs.github.com/en/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities#about-ssh-urls-with-ssh-certificates).
diff --git a/docs/pages/connect-your-client/includes/tsh-git.mdx b/docs/pages/connect-your-client/includes/tsh-git.mdx
new file mode 100644
index 0000000000000..03c22d0fe0e0b
--- /dev/null
+++ b/docs/pages/connect-your-client/includes/tsh-git.mdx
@@ -0,0 +1,43 @@
+Use `tsh git ls` to view a list of GitHub organizations you have access to:
+```code
+$ tsh git ls
+Type Organization Username URL
+------ ------------- -------- -------------------------
+GitHub my-org my-name https://github.com/my-org
+```
+
+Teleport requires your GitHub identity to impersonate you. If you haven't
+provided it yet, run the following command:
+```code
+$ tsh git login --github-org my-org
+ If browser window does not open automatically, open it by clicking on the link:
+ http://127.0.0.1:55555/some-id
+ Your GitHub username is my-name.
+```
+
+This command opens a browser, prompting you to authenticate with GitHub via the
+OAuth app:
+
+
+To clone a repository from your GitHub organization, find the SSH clone URL and
+run:
+```code
+$ tsh git clone git@github.com:my-org/my-repo.git
+Cloning into 'my-repo'...
+```
+
+To configure an existing Git repository with Teleport, go to the repository and
+run:
+```code
+$ tsh git config update
+The current Git directory is configured with Teleport for GitHub organization "my-org".
+```
+
+Once the repo is cloned or configured, you can use `git` commands as normal:
+```
+$ cd my-repo
+$ git fetch
+```
+
+Note that the OAuth app authentication flow and Git repository configuration are
+one-time setups. Once completed, you won’t need to repeat them.
\ No newline at end of file
diff --git a/docs/pages/connect-your-client/tsh.mdx b/docs/pages/connect-your-client/tsh.mdx
index 3ba2f50b5e587..fe3eb874ceb56 100644
--- a/docs/pages/connect-your-client/tsh.mdx
+++ b/docs/pages/connect-your-client/tsh.mdx
@@ -771,6 +771,10 @@ $ tsh status
Extensions: permit-X11-forwarding
```
+## Proxying Git commands
+
+(!docs/pages/connect-your-client/includes/tsh-git.mdx!)
+
## Custom aliases and defaults
You can configure `tsh` to define aliases, custom commands and command-specific flag defaults. Using aliases, you can run frequently used `tsh` commands more easily.
diff --git a/docs/pages/includes/role-spec.mdx b/docs/pages/includes/role-spec.mdx
index 1a0f2cfeece0c..ac8ff349abd1f 100644
--- a/docs/pages/includes/role-spec.mdx
+++ b/docs/pages/includes/role-spec.mdx
@@ -476,6 +476,12 @@ spec:
# 'foo.example.com'.
dns_sans: ["foo.svc.example.com"]
+ # GitHub-related permissions used for proxying Git commands.
+ github_permissions:
+ # List of GitHub organizations the user has access to.
+ - orgs:
+ - my-org
+
# rules allow a user holding this role to modify other resources
# matching the expressions below
# supported resources:
@@ -511,6 +517,7 @@ spec:
# kube_cluster - Kubernetes cluster resource
# token - provisioning token resource
# cert_authority - certificate authority resource
+ # git_server - Git server resource
#
# cluster_name - resource that contains the cluster name.
# cluster_config - resource that holds cluster level config