diff --git a/gerrit_util.py b/gerrit_util.py
index 9294d46cb..70c4bd68f 100644
--- a/gerrit_util.py
+++ b/gerrit_util.py
@@ -303,9 +303,10 @@ class SSOAuthenticator(Authenticator):
 
     @classmethod
     def is_applicable(cls) -> bool:
-        """If the git-remote-sso binary is in $PATH, we consider this
-        authenticator to be applicable."""
-        return bool(cls._resolve_sso_cmd())
+        if not cls._resolve_sso_cmd():
+            return False
+        email = scm.GIT.GetConfig(os.getcwd(), 'user.email', default='')
+        return email.endswith('@google.com')
 
     @classmethod
     def _parse_config(cls, config: str) -> SSOInfo:
diff --git a/tests/gerrit_util_test.py b/tests/gerrit_util_test.py
index 444a36f05..80b126542 100755
--- a/tests/gerrit_util_test.py
+++ b/tests/gerrit_util_test.py
@@ -623,7 +623,9 @@ class SSOAuthenticatorTest(unittest.TestCase):
         self.assertEqual(self.sso._resolve_sso_cmd(),
                          ('/fake/git-remote-sso', '-print_config',
                           'sso://*.git.corp.google.com'))
-        self.assertTrue(self.sso.is_applicable())
+        with mock.patch('scm.GIT.GetConfig') as p:
+            p.side_effect = ['firefly@google.com']
+            self.assertTrue(self.sso.is_applicable())
 
     @mock.patch('gerrit_util.ssoHelper.find_cmd', return_value=None)
     def testCmdAssemblyNotFound(self, _):