diff --git a/cesnet-central/deployments/fullhub.yaml b/cesnet-central/deployments/fullhub.yaml
index 47d474834799e79044ffddccd7798bca5b9d9ceb..d0df5cf99a088be969a51e49111e04b17cde7c46 100644
--- a/cesnet-central/deployments/fullhub.yaml
+++ b/cesnet-central/deployments/fullhub.yaml
@@ -167,9 +167,11 @@ hub:
       display: false
       api_token: "{{ secrets['zabbix_token'] }}"
   # recommended to keep in sync with common/playbooks/files/jupyterhub-jwt.yaml
+  # keep k8s-hub version in sync with ../playbooks/notebooks.yaml
   image:
     name: eginotebooks/hub
-    tag: "sha-2fa0db6"
+    # k8s-hub 3.3.8
+    tag: "sha-f5af1a3"
   config:
     Authenticator:
       enable_auth_state: true
diff --git a/common/deployments/hub-production.yaml b/common/deployments/hub-production.yaml
index 759c51119732c20d49d9ac00d122066f4ef1d656..7cadc18dcd0344dcbd4d9a113c209248925ddc6f 100644
--- a/common/deployments/hub-production.yaml
+++ b/common/deployments/hub-production.yaml
@@ -149,9 +149,11 @@ hub:
       display: false
       api_token: "{{ secrets['zabbix_token'] }}"
   # recommended to keep in sync with common/playbooks/files/jupyterhub-jwt.yaml
+  # keep k8s-hub version in sync with ../playbooks/notebooks.yaml
   image:
     name: eginotebooks/hub
-    tag: "sha-2fa0db6"
+    # k8s-hub 3.3.8
+    tag: "sha-f5af1a3"
   config:
     Authenticator:
       enable_auth_state: true
diff --git a/common/deployments/hub-staging.yaml b/common/deployments/hub-staging.yaml
index 1fd09d7474a9494a893996ba00e80791371b5155..6ec841e3698da63c5fc7bfeb9c80640dbefd6120 100644
--- a/common/deployments/hub-staging.yaml
+++ b/common/deployments/hub-staging.yaml
@@ -149,9 +149,11 @@ hub:
       display: false
       api_token: "{{ secrets['zabbix_token'] }}"
   # recommended to keep in sync with common/playbooks/files/jupyterhub-jwt.yaml
+  # keep k8s-hub version in sync with ../playbooks/notebooks.yaml
   image:
     name: eginotebooks/hub
-    tag: "sha-2fa0db6"
+    # k8s-hub 3.3.8
+    tag: "sha-f5af1a3"
   config:
     Authenticator:
       enable_auth_state: true
diff --git a/common/playbooks/files/jupyterhub-jwt.yaml b/common/playbooks/files/jupyterhub-jwt.yaml
index 98efb15f270f4aad56d059d235749e0d3de82f80..8eb4a773c41c8309a467d25f28c3466162e9091c 100644
--- a/common/playbooks/files/jupyterhub-jwt.yaml
+++ b/common/playbooks/files/jupyterhub-jwt.yaml
@@ -20,7 +20,7 @@ spec:
       containers:
         - name: jwt
           # recommended to keep it in sync with */deployments/*.yaml
-          image: eginotebooks/hub:sha-2fa0db6
+          image: eginotebooks/hub:sha-f5af1a3
           args:
             - fastapi
             - run
diff --git a/common/playbooks/notebooks.yaml b/common/playbooks/notebooks.yaml
index c687395975098becd0ce774966cdf3e336e9ae73..cc062399016f49c9d97a5485de1749251496c6ff 100644
--- a/common/playbooks/notebooks.yaml
+++ b/common/playbooks/notebooks.yaml
@@ -36,7 +36,8 @@
     - name: Deploy/upgrade notebook instance
       vars:
         name: "{{ item | basename | splitext | first }}"
-        version: "3.2.1" # app 4.0.2 (2023-11-27)
+        # keep in sync with ../deployments/*.yaml (original k8s-hub image version)
+        version: "3.3.8" # app 4.1.6 (2024-07-31)
       shell: |-
         helm status --namespace {{ name }} {{ name }}
         if [ $? -ne 0 ]; then
diff --git a/testing/deployments/hub.yaml b/testing/deployments/hub.yaml
index 4ece28429f17a1bdd2d03e96741d004940e95f0a..b208d2f4380d3074616ca441c0692abdfb1b770f 100644
--- a/testing/deployments/hub.yaml
+++ b/testing/deployments/hub.yaml
@@ -150,9 +150,11 @@ hub:
       display: false
       api_token: "{{ secrets['zabbix_token'] }}"
   # recommended to keep in sync with common/playbooks/files/jupyterhub-jwt.yaml
+  # keep k8s-hub version in sync with ../playbooks/notebooks.yaml
   image:
     name: eginotebooks/hub
-    tag: "sha-2fa0db6"
+    # k8s-hub 3.3.8
+    tag: "sha-f5af1a3"
   config:
     Authenticator:
       enable_auth_state: true