diff --git a/config/clusters/jupyter-health/common.values.yaml b/config/clusters/jupyter-health/common.values.yaml
index 75e5a8b5f3..d2911d2512 100644
--- a/config/clusters/jupyter-health/common.values.yaml
+++ b/config/clusters/jupyter-health/common.values.yaml
@@ -37,6 +37,13 @@ jupyterhub:
           name: "Jupyter Health"
           url: https://www.earthdata.nasa.gov/esds/veda
   hub:
+    # FIXME: Experiment to use oauthenticator 17.1, should be transitioned away
+    #        as part of upgrading to z2jh 4, see
+    #        https://github.com/2i2c-org/infrastructure/pull/4968
+    #
+    image:
+      name: quay.io/2i2c/pkce-experiment
+      tag: 0.0.1-0.dev.git.10694.h38ededaf
     allowNamedServers: true
     config:
       JupyterHub:
diff --git a/helm-charts/chartpress.yaml b/helm-charts/chartpress.yaml
index 1948922525..07d40f21ac 100644
--- a/helm-charts/chartpress.yaml
+++ b/helm-charts/chartpress.yaml
@@ -22,11 +22,12 @@ charts:
           REQUIREMENTS_FILE: dynamic-image-building-requirements.txt
         contextPath: images/hub
         dockerfilePath: images/hub/Dockerfile
-  - name: support
-    images:
-      gcp-filestore-backups:
-        imageName: quay.io/2i2c/gcp-filestore-backups
-        valuesPath: gcpFilestoreBackups.image
+      pkce-experiment:
+        imageName: quay.io/2i2c/pkce-experiment
+        buildArgs:
+          REQUIREMENTS_FILE: pkce-requirements.txt
+        contextPath: images/hub
+        dockerfilePath: images/hub/Dockerfile
   - name: aws-ce-grafana-backend
     images:
       aws-ce-grafana-backend:
diff --git a/helm-charts/images/hub/pkce-requirements.txt b/helm-charts/images/hub/pkce-requirements.txt
new file mode 100644
index 0000000000..43e986650c
--- /dev/null
+++ b/helm-charts/images/hub/pkce-requirements.txt
@@ -0,0 +1,14 @@
+# Image lives at quay.io/2i2c/pkce-experiment
+# install oauthenticator 17.1,
+# which adds PKCE support.
+# experiment no longer needed when base chart is updated to z2jh 4.0.0
+oauthenticator>=17.1,<18
+
+# jupyterhub-configurator isn't maintained and its not intended to be developed
+# further. We are using a branch that has forked from the main branch just
+# before a breaking change were made. This allows us to avoid migrating.
+#
+# ref: https://github.com/yuvipanda/jupyterhub-configurator/commits/main
+# ref: https://github.com/yuvipanda/jupyterhub-configurator/commits/backported-jh41-compatibility
+#
+git+https://github.com/yuvipanda/jupyterhub-configurator@backported-jh41-compatibility