diff --git a/helm-charts/images/hub/pkce-requirements.txt b/helm-charts/images/hub/pkce-requirements.txt
index 7d7a79968..14a1d9f1a 100644
--- a/helm-charts/images/hub/pkce-requirements.txt
+++ b/helm-charts/images/hub/pkce-requirements.txt
@@ -1,9 +1,8 @@
 # Image lives at quay.io/2i2c/pkce-experiment
-# install oauthenticator 17.1,
-# which adds PKCE support.
-# experiment no longer needed when base chart is updated to z2jh 4.0.0
-# Experiment with https://github.com/jupyterhub/oauthenticator/pull/780 and oauthenticator 17.2
-git+https://github.com/minrk/oauthenticator@refresh-skip
+# install oauthenticator 17.3,
+# which adds PKCE and refresh_token support
+# experiment no longer needed when base chart is updated to z2jh 4.1.0
+oauthenticator>=17.3,<18
 
 
 # jupyterhub-configurator isn't maintained and its not intended to be developed
@@ -16,4 +15,4 @@ git+https://github.com/minrk/oauthenticator@refresh-skip
 git+https://github.com/yuvipanda/jupyterhub-configurator@backported-jh41-compatibility
 
 # Brings in https://github.com/yuvipanda/jupyterhub-fancy-profiles
-jupyterhub-fancy-profiles==0.3.10
\ No newline at end of file
+jupyterhub-fancy-profiles==0.3.10