When OpenID Connect overrides email

On a self-hosted site using OpenID Connect, is there a supported Rails console method to mark an existing alternate email in user_emails as confirmed without changing the account’s primary email?

Goal: avoid duplicate accounts when OIDC returns the same email.

I found the documented console method for changing a user’s primary email, but I could not find documentation for confirming an alternate email row in place. Is editing user_emails supported, or should I avoid that and change the primary email instead?