diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,10 @@
-## [_Unreleased_](https://github.com/thoughtbot/yesod-auth-oauth2/compare/v0.7.2.0...main)
+## [_Unreleased_](https://github.com/thoughtbot/yesod-auth-oauth2/compare/v0.7.3.0...main)
+
+## [v0.7.3.0](https://github.com/thoughtbot/yesod-auth-oauth2/compare/v0.7.2.0...v0.7.3.0)
+
+- Add ORCID provider
+- Drop support for LTS-12 / GHC-8.6
+- Replace `cryptonite` with `crypton`
 
 ## [v0.7.2.0](https://github.com/thoughtbot/yesod-auth-oauth2/compare/v0.7.1.3...v0.7.2.0)
 
diff --git a/example/Main.hs b/example/Main.hs
--- a/example/Main.hs
+++ b/example/Main.hs
@@ -34,6 +34,7 @@
 import Yesod.Auth.OAuth2.GitLab
 import Yesod.Auth.OAuth2.Google
 import Yesod.Auth.OAuth2.Nylas
+import Yesod.Auth.OAuth2.ORCID
 import Yesod.Auth.OAuth2.Salesforce
 import Yesod.Auth.OAuth2.Slack
 import Yesod.Auth.OAuth2.Spotify
@@ -149,6 +150,7 @@
       , loadPlugin (oauth2Spotify []) "SPOTIFY"
       , loadPlugin oauth2Twitch "TWITCH"
       , loadPlugin oauth2WordPressDotCom "WORDPRESS_DOT_COM"
+      , loadPlugin oauth2ORCID "ORCID"
       , loadPlugin oauth2Upcase "UPCASE"
       ]
 
diff --git a/src/Yesod/Auth/OAuth2/Google.hs b/src/Yesod/Auth/OAuth2/Google.hs
--- a/src/Yesod/Auth/OAuth2/Google.hs
+++ b/src/Yesod/Auth/OAuth2/Google.hs
@@ -39,9 +39,8 @@
 instance FromJSON User where
   parseJSON =
     withObject "User" $ \o ->
-      User
-        -- Required for data backwards-compatibility
-        <$> (("google-uid:" <>) <$> o .: "sub")
+      -- Required for data backwards-compatibility
+      User . ("google-uid:" <>) <$> o .: "sub"
 
 pluginName :: Text
 pluginName = "google"
diff --git a/src/Yesod/Auth/OAuth2/ORCID.hs b/src/Yesod/Auth/OAuth2/ORCID.hs
new file mode 100644
--- /dev/null
+++ b/src/Yesod/Auth/OAuth2/ORCID.hs
@@ -0,0 +1,50 @@
+{-# LANGUAGE OverloadedStrings #-}
+
+module Yesod.Auth.OAuth2.ORCID
+  ( oauth2ORCID
+  ) where
+
+import qualified Data.Text as T
+import Yesod.Auth.OAuth2.Prelude
+
+pluginName :: Text
+pluginName = "orcid"
+
+newtype User = User Text
+
+instance FromJSON User where
+  parseJSON = withObject "User" $ \o -> User <$> o .: "sub"
+
+oauth2ORCID
+  :: YesodAuth m
+  => Text
+  -- ^ Client Id
+  -> Text
+  -- ^ Client Secret
+  -> AuthPlugin m
+oauth2ORCID clientId clientSecret =
+  authOAuth2 pluginName oauth2 $ \manager token -> do
+    (User userId, userResponse) <-
+      authGetProfile
+        pluginName
+        manager
+        token
+        "https://orcid.org/oauth/userinfo"
+
+    pure
+      Creds
+        { credsPlugin = pluginName
+        , credsIdent = T.pack $ show userId
+        , credsExtra = setExtra token userResponse
+        }
+ where
+  oauth2 =
+    OAuth2
+      { oauth2ClientId = clientId
+      , oauth2ClientSecret = Just clientSecret
+      , oauth2AuthorizeEndpoint =
+          "https://orcid.org/oauth/authorize"
+            `withQuery` [scopeParam " " ["openid"]]
+      , oauth2TokenEndpoint = "https://orcid.org/oauth/token"
+      , oauth2RedirectUri = Nothing
+      }
diff --git a/yesod-auth-oauth2.cabal b/yesod-auth-oauth2.cabal
--- a/yesod-auth-oauth2.cabal
+++ b/yesod-auth-oauth2.cabal
@@ -1,6 +1,6 @@
 cabal-version:   1.18
 name:            yesod-auth-oauth2
-version:         0.7.2.0
+version:         0.7.3.0
 license:         MIT
 license-file:    LICENSE
 maintainer:      engineering@freckle.com
@@ -50,6 +50,7 @@
         Yesod.Auth.OAuth2.GitLab
         Yesod.Auth.OAuth2.Google
         Yesod.Auth.OAuth2.Nylas
+        Yesod.Auth.OAuth2.ORCID
         Yesod.Auth.OAuth2.Prelude
         Yesod.Auth.OAuth2.Random
         Yesod.Auth.OAuth2.Salesforce
@@ -67,20 +68,20 @@
         aeson >=0.6,
         base >=4.9.0.0 && <5,
         bytestring >=0.9.1.4,
-        cryptonite >=0.25,
+        crypton >=1.0.0,
         errors >=2.3.0,
         hoauth2 >=1.11.0,
         http-client >=0.4.0,
         http-conduit >=2.0,
         http-types >=0.8,
-        memory >=0.14.18,
-        microlens >=0.4.10,
+        memory >=0.15.0,
+        microlens >=0.4.11.2,
         mtl >=2.2.2,
-        safe-exceptions >=0.1.7.0,
+        safe-exceptions >=0.1.7.1,
         text >=0.7,
         transformers >=0.5.6.2,
-        unliftio >=0.2.12,
-        uri-bytestring >=0.3.2.2,
+        unliftio >=0.2.13.1,
+        uri-bytestring >=0.3.3.0,
         yesod-auth >=1.6.0,
         yesod-core >=1.6.0
 
@@ -99,8 +100,8 @@
         http-conduit >=2.0,
         load-env >=0.2.1.0,
         text >=0.7,
-        warp >=3.3.5,
-        yesod >=1.6.0.1,
+        warp >=3.3.13,
+        yesod >=1.6.1.0,
         yesod-auth >=1.6.0,
         yesod-auth-oauth2
 
@@ -119,6 +120,6 @@
     ghc-options:      -Wall
     build-depends:
         base >=4.9.0.0 && <5,
-        hspec >=2.7.1,
-        uri-bytestring >=0.3.2.2,
+        hspec >=2.7.6,
+        uri-bytestring >=0.3.3.0,
         yesod-auth-oauth2