diff --git a/pkg/cmd/auth/shared/login_flow.go b/pkg/cmd/auth/shared/login_flow.go
index fbff9882e..6f75a784f 100644
--- a/pkg/cmd/auth/shared/login_flow.go
+++ b/pkg/cmd/auth/shared/login_flow.go
@@ -9,6 +9,7 @@ import (
 	"github.com/MakeNowJust/heredoc"
 	"github.com/cli/cli/api"
 	"github.com/cli/cli/internal/authflow"
+	"github.com/cli/cli/internal/ghinstance"
 	"github.com/cli/cli/pkg/iostreams"
 	"github.com/cli/cli/pkg/prompt"
 )
@@ -125,7 +126,7 @@ func Login(opts *LoginOptions) error {
 		fmt.Fprint(opts.IO.ErrOut, heredoc.Docf(`
 			Tip: you can generate a Personal Access Token here https://%s/settings/tokens
 			The minimum required scopes are %s.
-		`, hostname, scopesSentence(minimumScopes)))
+		`, hostname, scopesSentence(minimumScopes, ghinstance.IsEnterprise(hostname))))
 
 		err := prompt.SurveyAskOne(&survey.Password{
 			Message: "Paste your authentication token:",
@@ -193,11 +194,14 @@ func Login(opts *LoginOptions) error {
 	return nil
 }
 
-func scopesSentence(scopes []string) string {
+func scopesSentence(scopes []string, isEnterprise bool) string {
 	quoted := make([]string, len(scopes))
 	for i, s := range scopes {
 		quoted[i] = fmt.Sprintf("'%s'", s)
+		if s == "workflow" && isEnterprise {
+			// remove when GHE 2.x reaches EOL
+			quoted[i] += " (GHE 3.0+)"
+		}
 	}
-	// TODO: insert an "and" before the last element
 	return strings.Join(quoted, ", ")
 }
diff --git a/pkg/cmd/auth/shared/login_flow_test.go b/pkg/cmd/auth/shared/login_flow_test.go
index c37d89b46..521616dfa 100644
--- a/pkg/cmd/auth/shared/login_flow_test.go
+++ b/pkg/cmd/auth/shared/login_flow_test.go
@@ -101,3 +101,55 @@ func TestLogin_ssh(t *testing.T) {
 	assert.Equal(t, "ATOKEN", cfg["example.com:oauth_token"])
 	assert.Equal(t, "ssh", cfg["example.com:git_protocol"])
 }
+
+func Test_scopesSentence(t *testing.T) {
+	type args struct {
+		scopes       []string
+		isEnterprise bool
+	}
+	tests := []struct {
+		name string
+		args args
+		want string
+	}{
+		{
+			name: "basic scopes",
+			args: args{
+				scopes:       []string{"repo", "read:org"},
+				isEnterprise: false,
+			},
+			want: "'repo', 'read:org'",
+		},
+		{
+			name: "empty",
+			args: args{
+				scopes:       []string(nil),
+				isEnterprise: false,
+			},
+			want: "",
+		},
+		{
+			name: "workflow scope for dotcom",
+			args: args{
+				scopes:       []string{"repo", "workflow"},
+				isEnterprise: false,
+			},
+			want: "'repo', 'workflow'",
+		},
+		{
+			name: "workflow scope for GHE",
+			args: args{
+				scopes:       []string{"repo", "workflow"},
+				isEnterprise: true,
+			},
+			want: "'repo', 'workflow' (GHE 3.0+)",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := scopesSentence(tt.args.scopes, tt.args.isEnterprise); got != tt.want {
+				t.Errorf("scopesSentence() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}