diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 96bed38..f929a2b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -13,7 +13,7 @@ repos:
           - toml
 
   - repo: https://github.com/psf/black
-    rev: 22.1.0
+    rev: 22.3.0
     hooks:
       - id: black
 
diff --git a/Dockerfile b/Dockerfile
index 47f9015..2ace863 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM jupyterhub/jupyterhub:2.1.1 as base-image
+FROM jupyterhub/jupyterhub:2.2.0 as base-image
 
 # Update system packages
 COPY scripts/install-base-packages.sh .
diff --git a/Makefile b/Makefile
index 37e40c7..e6beacb 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 .PHONY: update-deps
 update-deps:
-	pip install --upgrade pip-tools 'pip<22' setuptools
+	pip install --upgrade pip-tools pip setuptools
 	pip-compile --upgrade --build-isolation --generate-hashes --output-file requirements/main.txt requirements/main.in
 	pip-compile --upgrade --build-isolation --generate-hashes --output-file requirements/dev.txt requirements/dev.in
 
diff --git a/requirements/dev.txt b/requirements/dev.txt
index 98a86dd..0da5096 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with python 3.10
+# This file is autogenerated by pip-compile with python 3.9
 # To update, run:
 #
 #    pip-compile --generate-hashes --output-file=requirements/dev.txt requirements/dev.in
@@ -374,6 +374,7 @@ pytest==7.1.1 \
     #   -r requirements/dev.in
     #   pytest-asyncio
 pytest-asyncio==0.18.3 \
+    --hash=sha256:16cf40bdf2b4fb7fc8e4b82bd05ce3fbcd454cbf7b92afc445fe299dabb88213 \
     --hash=sha256:7659bdb0a9eb9c6e3ef992eef11a2b3e69697800ad02fb06374a210d85b29f91 \
     --hash=sha256:8fafa6c52161addfd41ee7ab35f11836c5a16ec208f93ee388f752bea3493a84
     # via -r requirements/dev.in
diff --git a/requirements/main.in b/requirements/main.in
index 1a18c00..aeeec67 100644
--- a/requirements/main.in
+++ b/requirements/main.in
@@ -14,18 +14,14 @@ jupyterhub-idle-culler
 psycopg2
 ruamel.yaml
 tornado
-
 kubernetes-asyncio
-
-# Until changes are accepted upstream and a new kubespawner release happens:
-rubin-kubespawner
-# Until z2jh adopts kubespawner-asyncio:
-kubernetes
+jupyterhub-kubespawner
 
 # Always pin jupyterhub to a specific version.  We don't want it to be
 # upgraded without our explicit approval, and it should be upgraded in
-# lockstep with the base image in Dockerfile.
-jupyterhub==2.1.1
+# lockstep with the base image in Dockerfile and with the app version
+# in the JupyterHub helm chart (https://jupyterhub.github.io/helm-chart/)
+jupyterhub==2.2.0
 
 # Required by alembic for Python 3.8, so install it unconditionally until
 # Python 3.8 support is dropped so that we have consistent dependencies.
diff --git a/requirements/main.txt b/requirements/main.txt
index 14deb13..e8dd934 100644
--- a/requirements/main.txt
+++ b/requirements/main.txt
@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with python 3.10
+# This file is autogenerated by pip-compile with python 3.9
 # To update, run:
 #
 #    pip-compile --generate-hashes --output-file=requirements/main.txt requirements/main.in
@@ -95,9 +95,7 @@ alembic==1.7.7 \
 async-generator==1.10 \
     --hash=sha256:01c7bf666359b4967d2cda0000cc2e4af16a0ae098cbffcb8472fb9e8ad6585b \
     --hash=sha256:6ebb3d106c12920aaae42ccb6f787ef5eefdcdd166ea3d628fa8476abe712144
-    # via
-    #   jupyterhub
-    #   rubin-kubespawner
+    # via jupyterhub
 async-timeout==4.0.2 \
     --hash=sha256:2163e1640ddb52b7a8c80d0a67a08587e5d245cc9c553a74a847056bc2976b15 \
     --hash=sha256:8ca1e4fcf50d07413d66d1a5e416e42cfdf5851c981d679a09851a6853383b3c
@@ -108,10 +106,6 @@ attrs==21.4.0 \
     # via
     #   aiohttp
     #   jsonschema
-cachetools==5.0.0 \
-    --hash=sha256:486471dfa8799eb7ec503a8059e263db000cdda20075ce5e48903087f79d5fd6 \
-    --hash=sha256:8fecd4203a38af17928be7b90689d8083603073622229ca7077b72d8e5a976e4
-    # via google-auth
 cchardet==2.1.7 \
     --hash=sha256:0b859069bbb9d27c78a2c9eb997e6f4b738db2d7039a03f8792b4058d61d1109 \
     --hash=sha256:228d2533987c450f39acf7548f474dd6814c446e9d6bd228e8f1d9a2d210f10b \
@@ -147,7 +141,6 @@ certifi==2021.10.8 \
     --hash=sha256:78884e7c1d4b00ce3cea67b44566851c4343c120abd683433ce934a68ea58872 \
     --hash=sha256:d62a0163eb4c2344ac042ab2bdf75399a71a2d8c7d47eac2e2ee91b9d6339569
     # via
-    #   kubernetes
     #   kubernetes-asyncio
     #   requests
 certipy==0.1.3 \
@@ -243,7 +236,7 @@ entrypoints==0.4 \
 escapism==1.0.1 \
     --hash=sha256:73256bdfb4f22230f0428fc6efecee61cdc4fad531b6f98b849cb9c80711e4ec \
     --hash=sha256:d28f19edc3cb1ffc36fa238956ecc068695477e748f57157c6dde00a6b77f229
-    # via rubin-kubespawner
+    # via jupyterhub-kubespawner
 frozenlist==1.3.0 \
     --hash=sha256:006d3595e7d4108a12025ddf415ae0f6c9e736e726a5db0183326fd191b14c5e \
     --hash=sha256:01a73627448b1f2145bddb6e6c2259988bb8aee0fb361776ff8604b99616cd08 \
@@ -307,10 +300,6 @@ frozenlist==1.3.0 \
     # via
     #   aiohttp
     #   aiosignal
-google-auth==2.6.2 \
-    --hash=sha256:3ba4d63cb29c1e6d5ffcc1c0623c03cf02ede6240a072f213084749574e691ab \
-    --hash=sha256:60d449f8142c742db760f4c0be39121bc8d9be855555d784c252deaca1ced3f5
-    # via kubernetes
 greenlet==1.1.2 \
     --hash=sha256:0051c6f1f27cb756ffc0ffbac7d2cd48cb0362ac1736871399a739b2885134d3 \
     --hash=sha256:00e44c8afdbe5467e4f7b5851be223be68adb4272f44696ee71fe46b7036a711 \
@@ -392,7 +381,7 @@ jinja2==3.1.1 \
     # via
     #   -r requirements/main.in
     #   jupyterhub
-    #   rubin-kubespawner
+    #   jupyterhub-kubespawner
 jsonschema==4.4.0 \
     --hash=sha256:636694eb41b3535ed608fe04129f26542b59ed99808b4f688aa32dcf55317a83 \
     --hash=sha256:77281a1f71684953ee8b3d488371b162419767973789272434bbc3f29d9c8823
@@ -401,25 +390,25 @@ jupyter-telemetry==0.1.0 \
     --hash=sha256:1de3e423b23aa40ca4a4238d65c56dda544061ff5aedc3f7647220ed7e3b9589 \
     --hash=sha256:445c613ae3df70d255fe3de202f936bba8b77b4055c43207edf22468ac875314
     # via jupyterhub
-jupyterhub==2.1.1 \
-    --hash=sha256:386ae16dba48cb48f593bd1108cc01fb3c500cca607afae13e35d96461d7a19c \
-    --hash=sha256:ec93c94bd1a31917cb15269ee614c9b1cdda846cd20de5f25c5c7191cab19bb4
+jupyterhub==2.2.0 \
+    --hash=sha256:6aa7f15a5e198fa8aad8167a755508593e47719e7950fc09d7d1281b962343a4 \
+    --hash=sha256:e348d26d70072cbdc018d3375c12a8cff23fa8771a8d7ca75827710c83f93168
     # via
     #   -r requirements/main.in
-    #   rubin-kubespawner
+    #   jupyterhub-kubespawner
 jupyterhub-idle-culler==1.2.1 \
     --hash=sha256:c84e45a51932a34bd95c08b3b6e8330fb0ee3391fa4d0f1ac0d4458a40492fd9 \
     --hash=sha256:d80822982d2590cb876d01849cee028943fdbdcc991c0f02fce45af3f40dd415
     # via -r requirements/main.in
-kubernetes==23.3.0 \
-    --hash=sha256:05c98e4bd92f7091fa0fa58f594490e712c9151144d5f458235663a8909e342a \
-    --hash=sha256:223ff8f0ece5bc20fb65545f09a2308c5e1e9c0be83ae68504c1b1c6baa38f5b
+jupyterhub-kubespawner==3.0.2 \
+    --hash=sha256:26682d5fffa244de5b82cb3253e9bf91721ddb52bb10a8e1d9f5e3549ebb6593 \
+    --hash=sha256:e80410c4aede3eebdb61da38dfc5a89ec7d15047e21c32e67835d91701fcba85
     # via -r requirements/main.in
-kubernetes-asyncio==22.6.1 \
-    --hash=sha256:91a2f4c1cfc0cd1fe5ef8a5f3f24da20b4e8a93e28d6ce9b985df2b686c1edb5
+kubernetes-asyncio==22.6.2 \
+    --hash=sha256:ff1cb985a640aa7908c52fca098f32d2f3fd7d46f4725603f53864693b185c04
     # via
     #   -r requirements/main.in
-    #   rubin-kubespawner
+    #   jupyterhub-kubespawner
 mako==1.2.0 \
     --hash=sha256:23aab11fdbbb0f1051b93793a58323ff937e98e34aece1c4219675122e57e4ba \
     --hash=sha256:9a7c7e922b87db3686210cf49d5d767033a41d4010b284e747682c92bddd8b39
@@ -534,9 +523,7 @@ multidict==6.0.2 \
 oauthlib==3.2.0 \
     --hash=sha256:23a8208d75b902797ea29fd31fa80a15ed9dc2c6c16fe73f5d346f83f6fa27a2 \
     --hash=sha256:6db33440354787f9b7f3a6dbd4febf5d0f93758354060e802f6c06cb493022fe
-    # via
-    #   jupyterhub
-    #   requests-oauthlib
+    # via jupyterhub
 packaging==21.3 \
     --hash=sha256:dd47c42927d89ab911e606518907cc2d3a1f38bbd026385970643f9c5b8ecfeb \
     --hash=sha256:ef103e05f519cdc783ae24ea4e2e0f508a9c99b2d4969652eed6a2e1ea5bd522
@@ -562,16 +549,6 @@ psycopg2==2.9.3 \
     --hash=sha256:cb10d44e6694d763fa1078a26f7f6137d69f555a78ec85dc2ef716c37447e4b2 \
     --hash=sha256:d3ca6421b942f60c008f81a3541e8faf6865a28d5a9b48544b0ee4f40cac7fca
     # via -r requirements/main.in
-pyasn1==0.4.8 \
-    --hash=sha256:39c7e2ec30515947ff4e87fb6f456dfc6e84857d34be479c9d4a4ba4bf46aa5d \
-    --hash=sha256:aef77c9fb94a3ac588e87841208bdec464471d9871bd5050a287cc9a475cd0ba
-    # via
-    #   pyasn1-modules
-    #   rsa
-pyasn1-modules==0.2.8 \
-    --hash=sha256:905f84c712230b2c592c19470d3ca8d552de726050d1d1716282a1f6146be65e \
-    --hash=sha256:a50b808ffeb97cb3601dd25981f6b016cbb3d31fbf57a8b8a87428e6158d0c74
-    # via google-auth
 pycares==4.1.2 \
     --hash=sha256:03490be0e7b51a0c8073f877bec347eff31003f64f57d9518d419d9369452837 \
     --hash=sha256:056330275dea42b7199494047a745e1d9785d39fb8c4cd469dca043532240b80 \
@@ -646,7 +623,6 @@ python-dateutil==2.8.2 \
     # via
     #   jupyterhub
     #   jupyterhub-idle-culler
-    #   kubernetes
     #   kubernetes-asyncio
 python-json-logger==2.0.2 \
     --hash=sha256:202a4f29901a4b8002a6d1b958407eeb2dd1d83c18b18b816f5b64476dde9096 \
@@ -655,7 +631,7 @@ python-json-logger==2.0.2 \
 python-slugify==6.1.1 \
     --hash=sha256:00003397f4e31414e922ce567b3a4da28cf1436a53d332c9aeeb51c7d8c469fd \
     --hash=sha256:8c0016b2d74503eb64761821612d58fcfc729493634b1eb0575d8f5b4aa1fbcf
-    # via rubin-kubespawner
+    # via jupyterhub-kubespawner
 pyyaml==6.0 \
     --hash=sha256:0283c35a6a9fbf047493e3a0ce8d79ef5030852c51e9d911a27badfde0605293 \
     --hash=sha256:055d937d65826939cb044fc8c9b08889e8c743fdc6a32b33e2390f66013e449b \
@@ -691,24 +667,12 @@ pyyaml==6.0 \
     --hash=sha256:e61ceaab6f49fb8bdfaa0f92c4b57bcfbea54c09277b1b4f7ac376bfb7a7c174 \
     --hash=sha256:f84fbc98b019fef2ee9a1cb3ce93e3187a6df0b2538a651bfb890254ba9f90b5
     # via
-    #   kubernetes
+    #   jupyterhub-kubespawner
     #   kubernetes-asyncio
-    #   rubin-kubespawner
 requests==2.27.1 \
     --hash=sha256:68d7c56fd5a8999887728ef304a6d12edc7be74f1cfa47714fc8b414525c9a61 \
     --hash=sha256:f22fa1e554c9ddfd16e6e41ac79759e17be9e492b3587efa038054674760e72d
-    # via
-    #   jupyterhub
-    #   kubernetes
-    #   requests-oauthlib
-requests-oauthlib==1.3.1 \
-    --hash=sha256:2577c501a2fb8d05a304c09d090d6e47c306fef15809d102b327cf8364bddab5 \
-    --hash=sha256:75beac4a47881eeb94d5ea5d6ad31ef88856affe2332b9aafb52c6452ccf0d7a
-    # via kubernetes
-rsa==4.8 \
-    --hash=sha256:5c6bd9dc7a543b7fe4304a631f8a8a3b674e2bbfc49c2ae96200cdbe55df6b17 \
-    --hash=sha256:95c5d300c4e879ee69708c428ba566c59478fd653cc3a22243eeb8ed846950bb
-    # via google-auth
+    # via jupyterhub
 ruamel-yaml==0.17.21 \
     --hash=sha256:742b35d3d665023981bd6d16b3d24248ce5df75fdb4e2924e93a05c1f8b61ca7 \
     --hash=sha256:8b7ce697a2f212752a35c1ac414471dc16c424c9573be4926b56ff3f5d23b7af
@@ -742,54 +706,49 @@ ruamel-yaml-clib==0.2.6 \
     --hash=sha256:dc6a613d6c74eef5a14a214d433d06291526145431c3b964f5e16529b1842bed \
     --hash=sha256:de9c6b8a1ba52919ae919f3ae96abb72b994dd0350226e28f3686cb4f142165c
     # via ruamel-yaml
-rubin-kubespawner==2.0.1.dev6 \
-    --hash=sha256:3602bb5791a1ae8c1c8c9c4b4b56007ab8e16c520b703e1d2bb5b8a16dc6d339 \
-    --hash=sha256:709d36528f7dd631556ed3544b2f697f18f5751128962469dd5c72a9636d6bc1
-    # via -r requirements/main.in
 six==1.16.0 \
     --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
     --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
     # via
-    #   google-auth
-    #   kubernetes
     #   kubernetes-asyncio
     #   python-dateutil
-sqlalchemy==1.4.32 \
-    --hash=sha256:04164e0063feb7aedd9d073db0fd496edb244be40d46ea1f0d8990815e4b8c34 \
-    --hash=sha256:159c2f69dd6efd28e894f261ffca1100690f28210f34cfcd70b895e0ea7a64f3 \
-    --hash=sha256:199dc6d0068753b6a8c0bd3aceb86a3e782df118260ebc1fa981ea31ee054674 \
-    --hash=sha256:1bbac3e8293b34c4403d297e21e8f10d2a57756b75cff101dc62186adec725f5 \
-    --hash=sha256:20e9eba7fd86ef52e0df25bea83b8b518dfdf0bce09b336cfe51671f52aaaa3f \
-    --hash=sha256:290cbdf19129ae520d4bdce392648c6fcdbee763bc8f750b53a5ab51880cb9c9 \
-    --hash=sha256:316270e5867566376e69a0ac738b863d41396e2b63274616817e1d34156dff0e \
-    --hash=sha256:3f88a4ee192142eeed3fe173f673ea6ab1f5a863810a9d85dbf6c67a9bd08f97 \
-    --hash=sha256:4aa96e957141006181ca58e792e900ee511085b8dae06c2d08c00f108280fb8a \
-    --hash=sha256:4b2bcab3a914715d332ca783e9bda13bc570d8b9ef087563210ba63082c18c16 \
-    --hash=sha256:576684771456d02e24078047c2567025f2011977aa342063468577d94e194b00 \
-    --hash=sha256:5a2e73508f939175363d8a4be9dcdc84cf16a92578d7fa86e6e4ca0e6b3667b2 \
-    --hash=sha256:5ba59761c19b800bc2e1c9324da04d35ef51e4ee9621ff37534bc2290d258f71 \
-    --hash=sha256:5dc9801ae9884e822ba942ca493642fb50f049c06b6dbe3178691fce48ceb089 \
-    --hash=sha256:6fdd2dc5931daab778c2b65b03df6ae68376e028a3098eb624d0909d999885bc \
-    --hash=sha256:708973b5d9e1e441188124aaf13c121e5b03b6054c2df59b32219175a25aa13e \
-    --hash=sha256:7ff72b3cc9242d1a1c9b84bd945907bf174d74fc2519efe6184d6390a8df478b \
-    --hash=sha256:8679f9aba5ac22e7bce54ccd8a77641d3aea3e2d96e73e4356c887ebf8ff1082 \
-    --hash=sha256:8b9a395122770a6f08ebfd0321546d7379f43505882c7419d7886856a07caa13 \
-    --hash=sha256:8e1e5d96b744a4f91163290b01045430f3f32579e46d87282449e5b14d27d4ac \
-    --hash=sha256:9a0195af6b9050c9322a97cf07514f66fe511968e623ca87b2df5e3cf6349615 \
-    --hash=sha256:9cb5698c896fa72f88e7ef04ef62572faf56809093180771d9be8d9f2e264a13 \
-    --hash=sha256:b3f1d9b3aa09ab9adc7f8c4b40fc3e081eb903054c9a6f9ae1633fe15ae503b4 \
-    --hash=sha256:bb42f9b259c33662c6a9b866012f6908a91731a419e69304e1261ba3ab87b8d1 \
-    --hash=sha256:bca714d831e5b8860c3ab134c93aec63d1a4f493bed20084f54e3ce9f0a3bf99 \
-    --hash=sha256:bedd89c34ab62565d44745212814e4b57ef1c24ad4af9b29c504ce40f0dc6558 \
-    --hash=sha256:bfec934aac7f9fa95fc82147a4ba5db0a8bdc4ebf1e33b585ab8860beb10232f \
-    --hash=sha256:c7046f7aa2db445daccc8424f50b47a66c4039c9f058246b43796aa818f8b751 \
-    --hash=sha256:d7e483f4791fbda60e23926b098702340504f7684ce7e1fd2c1bf02029288423 \
-    --hash=sha256:dd93162615870c976dba43963a24bb418b28448fef584f30755990c134a06a55 \
-    --hash=sha256:e4607d2d16330757818c9d6fba322c2e80b4b112ff24295d1343a80b876eb0ed \
-    --hash=sha256:e9a680d9665f88346ed339888781f5236347933906c5a56348abb8261282ec48 \
-    --hash=sha256:edfcf93fd92e2f9eef640b3a7a40db20fe3c1d7c2c74faa41424c63dead61b76 \
-    --hash=sha256:f7e4a3c0c3c596296b37f8427c467c8e4336dc8d50f8ed38042e8ba79507b2c9 \
-    --hash=sha256:fff677fa4522dafb5a5e2c0cf909790d5d367326321aeabc0dffc9047cb235bd
+sqlalchemy==1.4.33 \
+    --hash=sha256:03b5dc8b6399a51187e220ab351dfa8f81c310ce59442d047b74cd91ac4e859a \
+    --hash=sha256:0539328f70f0c2bbaa0137be7a0787ceea7eda29e41e3a9d575c52030d4251aa \
+    --hash=sha256:0d19eed02bf1225889e6f91cd7c2f89618919cb283846e7ed8aae1b0fe5f0403 \
+    --hash=sha256:18a965490cc0f83f3e867078096e78e97d81bf370f45debae6027331904d3348 \
+    --hash=sha256:1a6ae212067856bf2236708cb434554851cbe8099027953e94241a1743afb2b1 \
+    --hash=sha256:1ee7c85f27b1ae59c3fe8fd715ed38e73ba8c885c90f74bcbae609c0fdb0ada3 \
+    --hash=sha256:3081f61a86d0c2b6928fa7f4666bdeba0b9c7cc19619255454a71bfa60b55978 \
+    --hash=sha256:34d2e697115cab4a66d1b8ea60050004ce62f0598c6cf146ee66a4025c7cb7fc \
+    --hash=sha256:36a3535bf9dd5f42a42d2cb6305f992888bbcb5789c615d35e34368853ae46f5 \
+    --hash=sha256:4443237f1f87d460453f6b33683f25135f3fba9dffbf2a053caae15bf838cfc2 \
+    --hash=sha256:44f0301e246c4d35d84e70192410d01509aea03a99cb963451aa0b652b7529f5 \
+    --hash=sha256:4b7371495c91319bfaa010e257eb8d3cd2d3eae14b256412d3294247ea7f0d78 \
+    --hash=sha256:5a43870fc272cf6dabf6ce7ad297a08e7f31672ea9ccd217a305c5bce8eafa9f \
+    --hash=sha256:5a5f798fc3f3ca9b5f1bf66b50a58439d558d5df132e12cfed22e2bc167c411c \
+    --hash=sha256:5b2718cb9e2bcf0053a83a6d0c491476b7f3832c59d82b53ccc78bb869e4027f \
+    --hash=sha256:5ee1ce25cc21db5553f607511fb41b85b7dc5eade15536c5c238f898996987de \
+    --hash=sha256:84747d1cc4823285b8253a34513162a664d4989217461e111097446b98803bfc \
+    --hash=sha256:89d51682716135e0d93584c3ca625c40805a014aaddb3961074a04895793d4d3 \
+    --hash=sha256:8b4cf1effee1ef6db3f6c5185d32c0e6518bcf06212861875779676a22f68370 \
+    --hash=sha256:9473d5dadee7a81d003cf18b1f5266b0fb29a9dff985bc205d71ca8da037e18b \
+    --hash=sha256:a11d8e12ff761101aa44404ce2df15e32f061d5559b862a847976c2efff014a1 \
+    --hash=sha256:a720cef2bcd4e645ae1fa01a143a31c04e095f26ff925f6090cb1ef7f1859e5d \
+    --hash=sha256:bda76918f8c6da01278a97365bc17fa97d902be7f6d7596aad2bd7d9b52adbba \
+    --hash=sha256:c3bbcfbaa33d5998698ed84eba0807a58023c86d0fa540ff4da96637815a4d92 \
+    --hash=sha256:c6545f832267bfea780c8fc6235f7a1fc87778e3e2629ddddeb88a94f9181292 \
+    --hash=sha256:c7c667579800445f390b56c37ee383639465766ebc2041a2d1f1279cda01d4a0 \
+    --hash=sha256:c8f671575256dddf1c334b2052aff88ac1c913e5430300057f1b0f2f12495019 \
+    --hash=sha256:cd4954eff9e9b9a294f632e7bdb0a4c41e23c89609c6b2f742f1321740566477 \
+    --hash=sha256:d258091ba28615ae133bf6a9975a24b9ed0bcc47f48bb1f57fa13cbe2bd4033c \
+    --hash=sha256:d29a8c0e8c2b77f2f548acdf948543a661f6414282598147e094bab091f37af6 \
+    --hash=sha256:dd51b09d540e757dd6377f02950a80c0dc63aec6188582afdc21bf0db66efa0a \
+    --hash=sha256:e403e1cfe7789eddba83bc7677dd8ffdaab56fb2f14eb3b6f014037b09cd8096 \
+    --hash=sha256:ea76d3f258c7b221a536fea200b64fc1b9272b48de4d1695bef616b7e5269183 \
+    --hash=sha256:eab54f6ec81c12b6184ebeacccd89567cee8fc94b2f9fba23aec30ca25fc287c \
+    --hash=sha256:f39fb329a53043c10814fee68e123f02addc6000ed96994aedf24afe6fc30e9b \
+    --hash=sha256:f409a1a44e3da766445600714e2ca70ddf735898382c11c5c250eb88a7b8b0d1
     # via
     #   alembic
     #   jupyterhub
@@ -853,14 +812,9 @@ urllib3==1.26.9 \
     --hash=sha256:44ece4d53fb1706f667c9bd1c648f5469a2ec925fcf3a776667042d645472c14 \
     --hash=sha256:aabaf16477806a5e1dd19aa41f8c2b7950dd3c746362d7e3223dbe6de6ac448e
     # via
-    #   kubernetes
+    #   jupyterhub-kubespawner
     #   kubernetes-asyncio
     #   requests
-    #   rubin-kubespawner
-websocket-client==1.3.1 \
-    --hash=sha256:074e2ed575e7c822fc0940d31c3ac9bb2b1142c303eafcf3e304e6ce035522e8 \
-    --hash=sha256:6278a75065395418283f887de7c3beafb3aa68dada5cacbe4b214e8d26da499b
-    # via kubernetes
 yarl==1.7.2 \
     --hash=sha256:044daf3012e43d4b3538562da94a88fb12a6490652dbc29fb19adfa02cf72eac \
     --hash=sha256:0cba38120db72123db7c58322fa69e3c0efa933040ffb586c3a87c063ec7cae8 \
@@ -938,7 +892,9 @@ yarl==1.7.2 \
 zipp==3.7.0 \
     --hash=sha256:9f50f446828eb9d45b267433fd3e9da8d801f614129124863f9c51ebceafb87d \
     --hash=sha256:b47250dd24f92b7dd6a0a8fc5244da14608f3ca90a5efcd37a3b1642fac9a375
-    # via importlib-metadata
+    # via
+    #   importlib-metadata
+    #   importlib-resources
 
 # WARNING: The following packages were not pinned, but pip requires them to be
 # pinned when the requirements file includes hashes. Consider using the --allow-unsafe flag.
diff --git a/src/nublado2/options.py b/src/nublado2/options.py
index 5bda139..da2dfaf 100644
--- a/src/nublado2/options.py
+++ b/src/nublado2/options.py
@@ -89,10 +89,10 @@
      name="enable_debug" value="true">
     <label for="enable_debug">Enable debug logs</label><br />
 
-    <input type="checkbox" id="clear_dotlocal"
-     name="clear_dotlocal" value="true">
-    <label for="clear_dotlocal">
-      Clear <tt>.local</tt> directory (caution!)
+    <input type="checkbox" id="reset_user_env"
+     name="reset_user_env" value="true">
+    <label for="reset_user_env">
+      Reset user environment: relocate .cache, .jupyter, and .local
     </label><br />
   </div>
 </td>
diff --git a/src/nublado2/resourcemgr.py b/src/nublado2/resourcemgr.py
index fae0400..e9afcb7 100644
--- a/src/nublado2/resourcemgr.py
+++ b/src/nublado2/resourcemgr.py
@@ -45,18 +45,11 @@ def __init__(self) -> None:
         self.provisioner = Provisioner()
         self.yaml = YAML()
         self.yaml.indent(mapping=2, sequence=4, offset=2)
-        # You can't create the shared_clients here; they fail to
-        #  serialize and the Hub won't start.
 
     async def create_user_resources(
         self, spawner: KubeSpawner, options: SelectedOptions
     ) -> None:
         """Create the user resources for this spawning session."""
-        # This actually gets called in a pre-spawn hook, which means no one
-        #  has yet called start() or poll() on the spawner, which means
-        #  we need to initialize its resources (particularly its API
-        #  client) ourselves.
-        await spawner.initialize_reflectors_and_clients()
         await self.provisioner.provision_homedir(spawner)
         try:
             await exponential_backoff(
@@ -118,7 +111,6 @@ async def _create_lab_environment_configmap(
     async def _create_kubernetes_resources(
         self, spawner: KubeSpawner, options: SelectedOptions
     ) -> None:
-        api_client = shared_client("ApiClient")
         custom_api = shared_client("CustomObjectsApi")
         template_values = await self._build_template_values(spawner, options)
 
@@ -158,7 +150,7 @@ async def _create_kubernetes_resources(
                 )
             else:
                 await asyncio.wait_for(
-                    create_from_dict(api_client, resource),
+                    create_from_dict(spawner.api.api_client, resource),
                     spawner.k8s_api_request_timeout,
                 )
 
@@ -189,7 +181,6 @@ async def _create_kubernetes_resources(
 
     async def _build_dask_template(self, spawner: KubeSpawner) -> str:
         """Build a template for dask workers from the jupyter pod manifest."""
-        api_client = shared_client("ApiClient")
         dask_template = await spawner.get_pod_manifest()
 
         # Here we make a few mangles to the jupyter pod manifest
@@ -211,7 +202,7 @@ async def _build_dask_template(self, spawner: KubeSpawner) -> str:
         # alone doesn't.
         dask_yaml_stream = StringIO()
         self.yaml.dump(
-            api_client.sanitize_for_serialization(dask_template),
+            spawner.api.api_client.sanitize_for_serialization(dask_template),
             dask_yaml_stream,
         )
         return dask_yaml_stream.getvalue()
diff --git a/src/nublado2/selectedoptions.py b/src/nublado2/selectedoptions.py
index f912451..69413f1 100644
--- a/src/nublado2/selectedoptions.py
+++ b/src/nublado2/selectedoptions.py
@@ -32,7 +32,7 @@ def __init__(self, options: Dict[str, Any]) -> None:
         self._size = nc.sizes[size_name]
 
         self._debug = "TRUE" if "enable_debug" in options else ""
-        self._clear_dotlocal = "TRUE" if "clear_dotlocal" in options else ""
+        self._reset_user_env = "TRUE" if "reset_user_env" in options else ""
 
     @property
     def debug(self) -> str:
@@ -43,12 +43,13 @@ def debug(self) -> str:
         return self._debug
 
     @property
-    def clear_dotlocal(self) -> str:
-        """String to pass in for CLEAR_DOTLOCAL variable in the lab.
+    def reset_user_env(self) -> str:
+        """String to pass in for RESET_USER_ENV variable in the lab.
 
-        This gets rid of the user's .local directory which may
-        cause issues during startup."""
-        return self._clear_dotlocal
+        This moves the user's .local, .cache, and .jupyter environments
+        aside.  That in turn allows getting out of the common case where
+        local package installation conflicts with the RSP machinery."""
+        return self._reset_user_env
 
     @property
     def image_info(self) -> ImageInfo:
diff --git a/tests/resourcemgr_test.py b/tests/resourcemgr_test.py
index ae217ec..e2c0d47 100644
--- a/tests/resourcemgr_test.py
+++ b/tests/resourcemgr_test.py
@@ -147,6 +147,7 @@ async def test_create_kubernetes_resources(
     spawner.hub.base_url = "/nb/hub/"
     spawner.user = Mock(spec=User)
     spawner.user.name = "someuser"
+    spawner.api = kubernetes_api_mock
     auth_state = {
         "token": "user-token",
         "uid": 1234,