diff --git a/jupyter/base/values/values.yaml b/jupyter/base/values/values.yaml
index 9a191b5..b41e600 100644
--- a/jupyter/base/values/values.yaml
+++ b/jupyter/base/values/values.yaml
@@ -161,6 +161,9 @@ hub:
       c.JupyterHub.load_roles = [
           {
               "name": "refresh-token",
+              "services": [
+                "refresh-token"
+              ]
               "scopes": [
                 "admin:auth_state"
               ]
@@ -168,8 +171,8 @@ hub:
           {
               "name": "user",
               "scopes": [
-                "access:services",
-                "read:services",
+                "access:services!service=refresh-token",
+                "read:services!service=refresh-token",
                 "self",
               ],
           }