diff --git a/orchestra/Chart.yaml b/orchestra/Chart.yaml
index 586d210..7c469be 100644
--- a/orchestra/Chart.yaml
+++ b/orchestra/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.1.6
+version: 3.1.8
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/orchestra/templates/infrastructure/mgmt-proxy.yaml b/orchestra/templates/infrastructure/mgmt-proxy.yaml
index 0ef7f10..b2886c4 100644
--- a/orchestra/templates/infrastructure/mgmt-proxy.yaml
+++ b/orchestra/templates/infrastructure/mgmt-proxy.yaml
@@ -52,6 +52,7 @@ rules:
   - "userextras/originaluser.jetstack.io-user"
   - "userextras/originaluser.jetstack.io-groups"
   - "userextras/originaluser.jetstack.io-extra"
+  - "userextras/authentication.kubernetes.io/credential-id"
   verbs:
   - "create"
   - "impersonate"
diff --git a/orchestra/templates/infrastructure/nginx.yaml b/orchestra/templates/infrastructure/nginx.yaml
index 5332bf6..61fc961 100644
--- a/orchestra/templates/infrastructure/nginx.yaml
+++ b/orchestra/templates/infrastructure/nginx.yaml
@@ -13,8 +13,10 @@ metadata:
     nginx.ingress.kubernetes.io/session-cookie-hash: sha1
     
     {{ range $key,$value := .Values.network.ingress_annotations }}
+    {{ if not ( eq $key "kubernetes.io/ingress.class"  )}}
     {{ $key }}: {{ quote $value }}
     {{ end }}
+    {{ end }}
   name: openunison-{{ .Release.Name }}
   namespace: {{ .Release.Namespace }}
   labels:
@@ -23,7 +25,7 @@ metadata:
     app.kubernetes.io/component: ingress-nginx
     app.kubernetes.io/part-of: openunison
 spec:
-  ingressClassName: nginx
+  ingressClassName: {{ index .Values.network.ingress_annotations "kubernetes.io/ingress.class" | default "nginx" }}
   rules:
   - host: {{ .Values.network.openunison_host }}
     http: