diff --git a/common/playbooks/files/jupyterhub-jwt.yaml b/common/playbooks/files/jupyterhub-jwt.yaml
index 8eb4a773c41c8309a467d25f28c3466162e9091c..2f9c188b14b4dc04834c91dfc3dc8524122dff0d 100644
--- a/common/playbooks/files/jupyterhub-jwt.yaml
+++ b/common/playbooks/files/jupyterhub-jwt.yaml
@@ -20,7 +20,7 @@ spec:
       containers:
         - name: jwt
           # recommended to keep it in sync with */deployments/*.yaml
-          image: eginotebooks/hub:sha-f5af1a3
+          image: eginotebooks/hub:sha-6edf89c
           args:
             - fastapi
             - run
diff --git a/common/playbooks/notebooks.yaml b/common/playbooks/notebooks.yaml
index cc062399016f49c9d97a5485de1749251496c6ff..5ebaa69ad88967a8710247432504ad4485a074bd 100644
--- a/common/playbooks/notebooks.yaml
+++ b/common/playbooks/notebooks.yaml
@@ -37,7 +37,7 @@
       vars:
         name: "{{ item | basename | splitext | first }}"
         # keep in sync with ../deployments/*.yaml (original k8s-hub image version)
-        version: "3.3.8" # app 4.1.6 (2024-07-31)
+        version: "4.0.0" # app 5.2.1 (2024-11-07)
       shell: |-
         helm status --namespace {{ name }} {{ name }}
         if [ $? -ne 0 ]; then
diff --git a/eosc-devel/deployments/fullhub.yaml b/eosc-devel/deployments/fullhub.yaml
index 4b9b4ddbab4daf4bc40ede354cd1c0761c00904e..67f34a4eeb544df1685b7dc31d1b9c0706346292 100644
--- a/eosc-devel/deployments/fullhub.yaml
+++ b/eosc-devel/deployments/fullhub.yaml
@@ -179,8 +179,8 @@ hub:
   # keep k8s-hub version in sync with ../playbooks/notebooks.yaml
   image:
     name: eginotebooks/hub
-    # k8s-hub 3.3.8
-    tag: "sha-f5af1a3"
+    # k8s-hub 4.0.0
+    tag: "sha-6edf89c"
   config:
     Authenticator:
       enable_auth_state: true
@@ -196,7 +196,7 @@ hub:
         - urn:geant:eosc-federation.eu:testing:group:eosc
       admin_groups:
         - urn:geant:eosc-federation.eu:group:asg:notebooks.open-science-cloud.ec.europa.eu:role=admin
-      claim_groups_key: "entitlements"
+      auth_state_groups_key: "oauth_user.entitlements"
     EGICheckinAuthenticator:
       checkin_host: "{{ secrets['checkin_host'] }}"
       authorize_url: "https://{{ secrets['checkin_host'] }}/OIDC/authorization"
diff --git a/eosc-testing/deployments/hub.yaml b/eosc-testing/deployments/hub.yaml
index 92601b2fe761fc4ee7cb5a57168260f39962ebdd..d07190478d62f150399f710cff032a4f0e29ad63 100644
--- a/eosc-testing/deployments/hub.yaml
+++ b/eosc-testing/deployments/hub.yaml
@@ -162,8 +162,8 @@ hub:
   # keep k8s-hub version in sync with ../playbooks/notebooks.yaml
   image:
     name: eginotebooks/hub
-    # k8s-hub 3.3.8
-    tag: "sha-f5af1a3"
+    # k8s-hub 4.0.0
+    tag: "sha-6edf89c"
   config:
     Authenticator:
       enable_auth_state: true
@@ -178,7 +178,7 @@ hub:
         - urn:geant:eosc-federation.eu:res:notebooks.open-science-cloud.ec.europa.eu:8-vcpu-16-gb-ram-gpu:act:ppa
       admin_groups:
         - urn:geant:eosc-federation.eu:group:asg:notebooks.open-science-cloud.ec.europa.eu:role=admin
-      claim_groups_key: "entitlements"
+      auth_state_groups_key: "oauth_user.entitlements"
     EGICheckinAuthenticator:
       checkin_host: "{{ secrets['checkin_host'] }}"
       authorize_url: "https://{{ secrets['checkin_host'] }}/OIDC/authorization"