diff --git a/charts/kubebrowser/Chart.yaml b/charts/kubebrowser/Chart.yaml
index ab2ff65..3900e8f 100644
--- a/charts/kubebrowser/Chart.yaml
+++ b/charts/kubebrowser/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: kubebrowser
 description: Allow whitelisted people to access your kubeconfigs
 type: application
-version: 1.3.2
+version: 1.4.0
 appVersion: "0.10.0"
 dependencies:
   - name: common
diff --git a/charts/kubebrowser/README.md b/charts/kubebrowser/README.md
index 5d4d799..ad2a45b 100644
--- a/charts/kubebrowser/README.md
+++ b/charts/kubebrowser/README.md
@@ -10,6 +10,7 @@ Prepare your `values.yaml`
 
 ```yaml
 server:
+  hostname: "kubebrowser.example.com" # match your redirect URI
   oidc:
     clientID: <your-client-id>
     clientSecret: <your-client-secret>
@@ -28,6 +29,14 @@ Install chart
 helm install my-kubebrowser avisto/kubebrowser -f values.yaml
 ```
 
+## Migration guide
+
+### From 1.3 to 1.4
+
+By default, `https` is now assumed for the `KUBEBROWSER_HOSTNAME` environment variable (used for oauth2 callback).
+
+Set `server.insecure=true` if you want to keep `http` prefix.
+
 ## Parameters
 
 ### Global values
@@ -96,6 +105,7 @@ helm install my-kubebrowser avisto/kubebrowser -f values.yaml
 | `server.hostNetwork`                                       | Specify if host network should be enabled for kubebrowser pod                                                                    | `false`                                                                                           |
 | `server.containerPorts.http`                               | kubebrowser server container port for http                                                                                       | `8080`                                                                                            |
 | `server.hostname`                                          | Hostname for kubebrowser server                                                                                                  | `""`                                                                                              |
+| `server.insecure`                                          | Whether kubebrowser should expect http or https for its own hostname (e.g. for oauth2 callback)                                  | `false`                                                                                           |
 | `server.hostIPC`                                           | Specify if host IPC should be enabled for kubebrowser pod                                                                        | `false`                                                                                           |
 | `server.labels`                                            | Map of labels to add to the statefulset                                                                                          | `{}`                                                                                              |
 | `server.annotations`                                       | Annotations for server pods                                                                                                      | `{}`                                                                                              |
diff --git a/charts/kubebrowser/templates/deployment.yaml b/charts/kubebrowser/templates/deployment.yaml
index 3089318..59df511 100644
--- a/charts/kubebrowser/templates/deployment.yaml
+++ b/charts/kubebrowser/templates/deployment.yaml
@@ -86,10 +86,8 @@ spec:
           env:
             - name: GIN_MODE
               value: "release"
-            {{- if or .Values.ingress.enabled .Values.httpRoute.enabled }}
             - name: KUBEBROWSER_HOSTNAME
-              value: {{ printf "%s://%s" (ternary "https" "http" (or .Values.ingress.tls (gt (len .Values.ingress.extraTls) 0) .Values.httpRoute.enabled)) (include "kubebrowser.hostname" $) }}
-            {{- end }}
+              value: {{ printf "%s://%s" (ternary "http" "https" .Values.server.insecure) (include "kubebrowser.hostname" $) }}
             - name: KUBEBROWSER_OAUTH2_CLIENT_ID
               valueFrom:
                 secretKeyRef:
diff --git a/charts/kubebrowser/values.schema.json b/charts/kubebrowser/values.schema.json
index 0cbbec6..973a76f 100644
--- a/charts/kubebrowser/values.schema.json
+++ b/charts/kubebrowser/values.schema.json
@@ -366,6 +366,11 @@
                     "description": "Hostname for kubebrowser server",
                     "default": ""
                 },
+                "insecure": {
+                    "type": "boolean",
+                    "description": "Whether kubebrowser should expect http or https for its own hostname (e.g. for oauth2 callback)",
+                    "default": false
+                },
                 "hostIPC": {
                     "type": "boolean",
                     "description": "Specify if host IPC should be enabled for kubebrowser pod",
diff --git a/charts/kubebrowser/values.yaml b/charts/kubebrowser/values.yaml
index 6583765..efb4323 100644
--- a/charts/kubebrowser/values.yaml
+++ b/charts/kubebrowser/values.yaml
@@ -199,6 +199,9 @@ server:
   ## @param server.hostname Hostname for kubebrowser server
   ##
   hostname: ""
+  ## @param server.insecure Whether kubebrowser should expect http or https for its own hostname (e.g. for oauth2 callback)
+  #
+  insecure: false
   ## @param server.hostIPC Specify if host IPC should be enabled for kubebrowser pod
   ##
   hostIPC: false