diff --git a/config/clusters/2i2c/dask-staging.values.yaml b/config/clusters/2i2c/dask-staging.values.yaml
index 35e69c63d..c040f9ec9 100644
--- a/config/clusters/2i2c/dask-staging.values.yaml
+++ b/config/clusters/2i2c/dask-staging.values.yaml
@@ -31,7 +31,7 @@ basehub:
     singleuser:
       image:
         name: pangeo/pangeo-notebook
-        tag: "2021.02.19"
+        tag: "2022.06.02"
     hub:
       config:
         JupyterHub:
diff --git a/config/clusters/meom-ige/common.values.yaml b/config/clusters/meom-ige/common.values.yaml
index 4c461e17a..cdc823a1c 100644
--- a/config/clusters/meom-ige/common.values.yaml
+++ b/config/clusters/meom-ige/common.values.yaml
@@ -77,7 +77,7 @@ basehub:
       defaultUrl: /lab
       image:
         name: pangeo/pangeo-notebook
-        tag: "2021.07.17"
+        tag: "2022.06.13"
     scheduling:
       userPlaceholder:
         enabled: false
diff --git a/helm-charts/basehub/Chart.yaml b/helm-charts/basehub/Chart.yaml
index 83a831aff..4b76ee29f 100644
--- a/helm-charts/basehub/Chart.yaml
+++ b/helm-charts/basehub/Chart.yaml
@@ -11,5 +11,5 @@ dependencies:
     # images/hub/Dockerfile, and will also involve manually building and pushing
     # the Dockerfile to https://quay.io/2i2c/pilot-hub. Details about this can
     # be found in the Dockerfile's comments.
-    version: 1.2.0
+    version: 1.1.3-n648.hab95aa08
     repository: https://jupyterhub.github.io/helm-chart/
diff --git a/helm-charts/basehub/values.yaml b/helm-charts/basehub/values.yaml
index 3674456fb..f7024a14e 100644
--- a/helm-charts/basehub/values.yaml
+++ b/helm-charts/basehub/values.yaml
@@ -135,7 +135,14 @@ jupyterhub:
         limits:
           memory: 1Gi
   singleuser:
+    cmd:
+      # Explicitly define this, as it's no longer set by z2jh
+      # https://github.com/jupyterhub/zero-to-jupyterhub-k8s/pull/2449
+      - jupyterhub-singleuser
     extraEnv:
+      # until https://github.com/jupyterhub/jupyterhub/pull/3918 or equivalent lands,
+      # and we upgrade to jupyterhub >= 2.3.1 on all images.
+      JUPYTERHUB_SINGLEUSER_APP: "notebook.notebookapp.NotebookApp"
       # notebook writes secure files that don't need to survive a
       # restart here. Writing 'secure' files on some file systems (like
       # Azure Files with SMB) seems buggy, so we just put runtime dir on
@@ -169,7 +176,7 @@ jupyterhub:
       hub.jupyter.org/node-purpose: user
     image:
       name: quay.io/2i2c/2i2c-hubs-image
-      tag: "532c5eab47a1"
+      tag: 69b1f9dff7c7
     storage:
       type: static
       static:
@@ -247,6 +254,15 @@ jupyterhub:
                 matchLabels:
                   app.kubernetes.io/component: traefik
   hub:
+    loadRoles:
+      # Should use this, not hub.config.JupyterHub.load_roles - that will
+      # override any existing load_roles set by z2jh
+      service-use:
+        name: user
+        scopes:
+          # Allow all users access to 'services', which includes dask-gateway & configurator
+          - access:services
+          - self
     config:
       JupyterHub:
         # Allow unauthenticated prometheus requests
@@ -321,7 +337,7 @@ jupyterhub:
         admin: true
     image:
       name: quay.io/2i2c/pilot-hub
-      tag: "0.0.1-n3288.h27beafd1"
+      tag: "0.0.1-n3521.hb54fb723"
     nodeSelector:
       hub.jupyter.org/node-purpose: core
     networkPolicy:
diff --git a/helm-charts/images/hub/Dockerfile b/helm-charts/images/hub/Dockerfile
index 7bf49ecad..e835f1717 100644
--- a/helm-charts/images/hub/Dockerfile
+++ b/helm-charts/images/hub/Dockerfile
@@ -6,18 +6,12 @@
 # quay.io container registry credentials configured to have access to
 # https://quay.io/repository/2i2c/pilot-hub.
 #
-FROM jupyterhub/k8s-hub:1.2.0
+FROM jupyterhub/k8s-hub:1.1.3-n644.h35436cda
 
 ENV CONFIGURATOR_VERSION ed7e3a0df1e3d625d10903ef7d7fd9c2fbb548db
 
 RUN pip install --no-cache git+https://github.com/yuvipanda/jupyterhub-configurator@${CONFIGURATOR_VERSION}
 
-
-# Install newer version of jupyterhub-kubespawner, to bring in https://github.com/jupyterhub/kubespawner/pull/525
-# https://github.com/2i2c-org/infrastructure/issues/1103 is happening frequently enough
-# z2jh 1.2.x ships with kubespawner 1.1.0, so we just do a little bump
-RUN pip install --no-cache --upgrade jupyterhub-kubespawner==1.1.2
-
 # Latest version comes with some breaking changes https://oauthenticator.readthedocs.io/en/latest/migrations.html#migrating-cilogonoauthenticator-to-version-15-0
 RUN pip install --no-cache --upgrade oauthenticator==15.0.1