diff --git a/builtin/credential/github/backend.go b/builtin/credential/github/backend.go
index b53e95f986e5..6e4cd3d1d6dc 100644
--- a/builtin/credential/github/backend.go
+++ b/builtin/credential/github/backend.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/google/go-github/github"
 	"github.com/hashicorp/go-cleanhttp"
+	"github.com/hashicorp/vault/helper/mfa"
 	"github.com/hashicorp/vault/logical"
 	"github.com/hashicorp/vault/logical/framework"
 	"golang.org/x/oauth2"
@@ -35,11 +36,11 @@ func Backend() *backend {
 	}
 
 	allPaths := append(b.TeamMap.Paths(), b.UserMap.Paths()...)
-
 	b.Backend = &framework.Backend{
 		Help: backendHelp,
 
 		PathsSpecial: &logical.Paths{
+			Root: mfa.MFARootPaths(),
 			Unauthenticated: []string{
 				"login",
 			},
@@ -47,9 +48,7 @@ func Backend() *backend {
 
 		Paths: append([]*framework.Path{
 			pathConfig(&b),
-			pathLogin(&b),
-		}, allPaths...),
-
+		}, append(allPaths, mfa.MFAPaths(b.Backend, pathLogin(&b))...)...),
 		AuthRenew:   b.pathLoginRenew,
 		BackendType: logical.TypeCredential,
 	}