diff --git a/charts/kubeflow/common/oidc-client/oauth2-proxy/base/kustomization.yaml b/charts/kubeflow/common/oidc-client/oauth2-proxy/base/kustomization.yaml
index 363afae..0b9a5ec 100644
--- a/charts/kubeflow/common/oidc-client/oauth2-proxy/base/kustomization.yaml
+++ b/charts/kubeflow/common/oidc-client/oauth2-proxy/base/kustomization.yaml
@@ -21,6 +21,12 @@ secretGenerator:
   envs:
   - secrets.env
 
+patches:
+- target:
+    kind: ConfigMap
+    name: oauth2-proxy
+  path: patch-oauth2-proxy-config.yaml
+
 configMapGenerator:
 - name: oauth2-proxy-parameters
   literals:
diff --git a/charts/kubeflow/common/oidc-client/oauth2-proxy/base/patch-oauth2-proxy-config.yaml b/charts/kubeflow/common/oidc-client/oauth2-proxy/base/patch-oauth2-proxy-config.yaml
new file mode 100644
index 0000000..c57427d
--- /dev/null
+++ b/charts/kubeflow/common/oidc-client/oauth2-proxy/base/patch-oauth2-proxy-config.yaml
@@ -0,0 +1,52 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: oauth2-proxy
+  labels:
+    app: oauth2-proxy
+data:
+  oauth2_proxy.cfg: |
+    provider = "keycloak-oidc"
+    oidc_issuer_url = $OIDC_ISSUER_URL
+    scope = "profile email roles openid"
+    upstreams = "static://200"
+    email_domains = [ "*" ]
+    # ---
+    # OIDC Discovery has to be skipped and login url has to be provided directly
+    # in order to enable relative auth redirect.
+    # Turning On OIDC Discovery would set the auth redirect location as the dex
+    # Issuer URL which is http://dex.auth.svc.cluster.local:5556 in the default,
+    # example installation. This address is usuallynot available through the Web
+    # Browser. If you have a setup where dex has it's url as other than the
+    # in-cluster service, this is optional.
+    # ---
+    # Go to dex login page directly instead of showing the oauth2-proxy login
+    # page.
+    skip_provider_button = true
+    # ---
+    # Set Authorization Bearer response header. This is needed in order to
+    # forward the Authorization Bearer token to Istio and enable authorization
+    # based on JWT.
+    set_authorization_header = true
+    # ---
+    # set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and
+    # X-Auth-Request-Preferred-Username. This is optional for Kubeflow but you
+    # may have other services that use standard auth headers.
+    set_xauthrequest = true
+    # ---
+    cookie_name = "oauth2_proxy_kubeflow"
+    # ---
+    # Dex default cookie expiration is 24h. If set to 168h (default oauth2-proxy),
+    # Istio will not be able to use the JWT after 24h but oauth2-proxy will still
+    # consider the cookie valid.
+    # It's possible to configure the JWT Refresh Token to enable longer login
+    # session.
+    cookie_expire = "24h"
+    cookie_refresh = "5m"
+    # ---
+    code_challenge_method = "S256"
+    # ---
+    redirect_url = $REDIRECT_URL
+    relative_redirect_url = true
+
+binaryData: {}