diff --git a/jupyter/base/charts/jupyterhub/templates/hub/deployment.yaml b/jupyter/base/charts/jupyterhub/templates/hub/deployment.yaml
index d6e1c63..2110654 100644
--- a/jupyter/base/charts/jupyterhub/templates/hub/deployment.yaml
+++ b/jupyter/base/charts/jupyterhub/templates/hub/deployment.yaml
@@ -211,6 +211,8 @@ spec:
           ports:
             - name: http
               containerPort: 8081
+            - name: refresh-token
+              containerPort: 8082
           {{- if .Values.hub.livenessProbe.enabled }}
           {{- /* NOTE:
             We don't know how long hub database upgrades could take so having a
diff --git a/jupyter/base/values/values.yaml b/jupyter/base/values/values.yaml
index 79bd9c3..82df309 100644
--- a/jupyter/base/values/values.yaml
+++ b/jupyter/base/values/values.yaml
@@ -1,4 +1,17 @@
 hub:
+  networkPolicy:
+    ingress:
+      - ports:
+          - port: 8082
+        from:
+          - podSelector:
+              matchLabels:
+                hub.jupyter.org/network-access-hub: "true"
+  service:
+    extraPorts:
+      - port: 8082
+        targetPort: 8082
+        name: refresh-token
   config:
     Authenticator:
       auto_login: true