diff --git a/traefik-forward-auth/Chart.yaml b/traefik-forward-auth/Chart.yaml
index f61c0a3..625a01f 100644
--- a/traefik-forward-auth/Chart.yaml
+++ b/traefik-forward-auth/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: traefik-forward-auth
 description: Forward auth for Traefik (ItalyPaleAle/traefik-forward-auth) with Pocket ID provider
 type: application
-version: 0.2.0
+version: 0.2.1
 appVersion: "4.14.1"
 annotations:
   version-source: github-release:ItalyPaleAle/traefik-forward-auth
diff --git a/traefik-forward-auth/templates/_helpers.tpl b/traefik-forward-auth/templates/_helpers.tpl
index bb2cb02..9d2b369 100644
--- a/traefik-forward-auth/templates/_helpers.tpl
+++ b/traefik-forward-auth/templates/_helpers.tpl
@@ -29,6 +29,7 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 - name: {{ .name | quote }}
   endpoint: {{ .pocketID.endpoint | quote }}
   clientID: {{ .pocketID.clientID | quote }}
+  enablePKCE: {{ if hasKey .pocketID "enablePKCE" }}{{ .pocketID.enablePKCE }}{{ else }}true{{ end }}
   existingSecret: {{ required "each portal needs an existingSecret" .existingSecret | quote }}
   secretKey: {{ .secretKey | default "client-secret" | quote }}
   middlewareName: {{ .middlewareName | default (printf "%s-%s" $.Release.Name .name) | quote }}
@@ -37,6 +38,7 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 - name: {{ .Values.portal.name | quote }}
   endpoint: {{ .Values.pocketID.endpoint | quote }}
   clientID: {{ .Values.pocketID.clientID | quote }}
+  enablePKCE: {{ if hasKey .Values.pocketID "enablePKCE" }}{{ .Values.pocketID.enablePKCE }}{{ else }}true{{ end }}
   existingSecret: {{ required "existingSecret is required" .Values.existingSecret | quote }}
   secretKey: "client-secret"
   middlewareName: {{ include "tfa.middlewareName" . | quote }}
diff --git a/traefik-forward-auth/templates/configmap.yaml b/traefik-forward-auth/templates/configmap.yaml
index d82d659..801016e 100644
--- a/traefik-forward-auth/templates/configmap.yaml
+++ b/traefik-forward-auth/templates/configmap.yaml
@@ -27,6 +27,7 @@ data:
           - pocketID:
               endpoint: {{ .endpoint | quote }}
               clientID: {{ .clientID | quote }}
+              enablePKCE: {{ .enablePKCE }}
               clientSecretFile: "{{ include "tfa.secretDir" $ }}/{{ .name }}/client-secret"
       {{- end }}
     {{- with .Values.extraConfig }}
diff --git a/traefik-forward-auth/values.yaml b/traefik-forward-auth/values.yaml
index 3509389..27c1798 100644
--- a/traefik-forward-auth/values.yaml
+++ b/traefik-forward-auth/values.yaml
@@ -41,11 +41,17 @@ portals: []
   #   pocketID:
   #     endpoint: https://id.example.com
   #     clientID: "..."
+  #     enablePKCE: true
 
 # Single-portal shorthand, used when `portals` is empty.
 pocketID:
   endpoint: ""
   clientID: ""
+  # Send a PKCE code_challenge on the authorization request. Pocket ID rejects
+  # the request outright ("This client requires PKCE") when its OIDC client has
+  # PKCE required, which is the default for new clients. Harmless when the
+  # client does not require it, so this defaults on.
+  enablePKCE: true
 
 # Secret containing the client secret. Must define key `client-secret`.
 # Use sealed-secrets to provide this in cluster overlays.