diff --git a/open-webui/main.yaml b/open-webui/main.yaml
index 0b5570a..51a1368 100644
--- a/open-webui/main.yaml
+++ b/open-webui/main.yaml
@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: open-webui
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: open-webui
-    app.kubernetes.io/version: 0.6.40
-    helm.sh/chart: open-webui-8.18.0
+    app.kubernetes.io/version: 0.6.42
+    helm.sh/chart: open-webui-8.21.0
   name: existing-sa
   namespace: open-webui
 ---
@@ -33,8 +33,8 @@ metadata:
     app.kubernetes.io/instance: open-webui
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: open-webui
-    app.kubernetes.io/version: 0.6.40
-    helm.sh/chart: open-webui-8.18.0
+    app.kubernetes.io/version: 0.6.42
+    helm.sh/chart: open-webui-8.21.0
   name: open-webui
   namespace: open-webui
 spec:
@@ -159,8 +159,8 @@ metadata:
     app.kubernetes.io/instance: open-webui
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: open-webui
-    app.kubernetes.io/version: 0.6.40
-    helm.sh/chart: open-webui-8.18.0
+    app.kubernetes.io/version: 0.6.42
+    helm.sh/chart: open-webui-8.21.0
   name: open-webui
   namespace: open-webui
 spec:
@@ -177,8 +177,8 @@ spec:
         app.kubernetes.io/instance: open-webui
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: open-webui
-        app.kubernetes.io/version: 0.6.40
-        helm.sh/chart: open-webui-8.18.0
+        app.kubernetes.io/version: 0.6.42
+        helm.sh/chart: open-webui-8.21.0
     spec:
       automountServiceAccountToken: false
       containers:
@@ -215,13 +215,13 @@ spec:
         - name: OAUTH_ALLOWED_ROLES
           value: default-roles-home
         - name: OAUTH_ADMIN_ROLES
-          value: ADMIN
+          value: app_admin
         - name: WEBSOCKET_REDIS_URL
           valueFrom:
             secretKeyRef:
               key: redis_url
               name: open-webui
-        image: ghcr.io/open-webui/open-webui:0.6.40
+        image: ghcr.io/open-webui/open-webui:0.6.42
         imagePullPolicy: IfNotPresent
         name: open-webui
         ports:
@@ -237,7 +237,7 @@ spec:
         - sh
         - -c
         - cp -R -n /app/backend/data/* /tmp/app-data/
-        image: ghcr.io/open-webui/open-webui:0.6.40
+        image: ghcr.io/open-webui/open-webui:0.6.42
         imagePullPolicy: IfNotPresent
         name: copy-app-data
         volumeMounts:
diff --git a/open-webui/src/kustomization.yaml b/open-webui/src/kustomization.yaml
index 1796ff9..17a473a 100644
--- a/open-webui/src/kustomization.yaml
+++ b/open-webui/src/kustomization.yaml
@@ -5,7 +5,7 @@ kind: Kustomization
 helmCharts:
   - name: open-webui
     repo: https://helm.openwebui.com/
-    version: 8.18.0
+    version: 8.21.0
     releaseName: open-webui
     includeCRDs: true
     namespace: open-webui
diff --git a/open-webui/src/values.yaml b/open-webui/src/values.yaml
index 12279b9..ed2d7c9 100644
--- a/open-webui/src/values.yaml
+++ b/open-webui/src/values.yaml
@@ -57,7 +57,7 @@ websocket:
   manager: redis
   # -- Specifies the URL of the Redis instance for websocket communication. Template with `redis://[:<password>@]<hostname>:<port>/<db>`
   # @section -- Websocket configuration
-  url: ""
+  url: redis://open-webui-redis:6379/0
   # -- Node selector for websocket pods
   # @section -- Websocket configuration
   nodeSelector: {}
@@ -139,6 +139,14 @@ websocket:
       # runAsUser: 999
       # runAsGroup: 1000
 
+
+workload:
+  # -- Workload kind to use. Options are "Deployment", "StatefulSet".
+  # If not set, the chart will determine the kind based on persistence settings.
+  # NOTE: When using Deployment with local persistence and replicaCount > 1,
+  # ensure persistence.accessModes includes ReadWriteMany (RWX).
+  kind: ""
+
 # -- Value of cluster domain
 clusterDomain: cluster.local
 
@@ -662,7 +670,7 @@ sso:
     allowedRoles: "default-roles-home"
     # -- Comma-separated list of roles allowed to log in as admin (receive open webui role admin)
     # @section -- Role management configuration
-    adminRoles: "ADMIN"
+    adminRoles: "app_admin"
   groupManagement:
     # -- The claim that contains the groups (can be nested, e.g., user.memberOf)
     # @section -- SSO Configuration