diff --git a/.gitignore b/.gitignore
index af2f1592..db085d27 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
+*lock
 pangeo-deploy/charts/
 pangeo-deploy/requirements.lock
diff --git a/deployments/icesat2/config/common.yaml b/deployments/icesat2/config/common.yaml
index 20b03e32..546bd140 100644
--- a/deployments/icesat2/config/common.yaml
+++ b/deployments/icesat2/config/common.yaml
@@ -52,11 +52,11 @@ pangeo:
       cloudMetadata:
         enabled: true
       cpu:
+        guarantee: 2
         limit: 4
-        guarantee: 3
       memory:
-        limit: 16G
-        guarantee: 14G
+        guarantee: 7G
+        limit: 7G
     auth:
       github:
         orgWhitelist:
@@ -73,12 +73,10 @@ pangeo:
         users:
           - scottyhq
           - jhamman
-          - apawloski
-          - amanda-tan
     hub:
       resources:
         requests:
-          cpu: 0.45
+          cpu: 0.5
           memory: 1G
         limits:
           cpu: 1.25
diff --git a/deployments/icesat2/config/prod.yaml b/deployments/icesat2/config/prod.yaml
index d417debb..c2963715 100644
--- a/deployments/icesat2/config/prod.yaml
+++ b/deployments/icesat2/config/prod.yaml
@@ -1,14 +1,22 @@
 # Leave commented for first build, then uncomment and add loadBalancerIP
 pangeo:
   jupyterhub:
+    hub:
+      services:
+        dask-gateway:
+          # This makes the gateway available at ${HUB_URL}/services/dask-gateway
+          url: http://web-public-icesat2-prod-dask-gateway
+    singleuser:
+      extraEnv:
+        DASK_GATEWAY__ADDRESS: "http://web-public-icesat2-prod-dask-gateway/services/dask-gateway/"
+        DASK_GATEWAY__PROXY_ADDRESS: "tls://scheduler-icesat2-prod-dask-gateway:8786"
+        DASK_GATEWAY__AUTH_TYPE: "jupyterhub"
     proxy:
       https:
         hosts:
           - aws-uswest2.pangeo.io
         letsencrypt:
           contactEmail: scottyh@uw.edu
-      service:
-        loadBalancerIP: aa19367a4573811e9a9ef06d2bcc51c9-1125496385.us-west-2.elb.amazonaws.com
     auth:
       github:
         callbackUrl: "https://aws-uswest2.pangeo.io/hub/oauth_callback"
diff --git a/deployments/icesat2/config/staging.yaml b/deployments/icesat2/config/staging.yaml
index b9325969..a59f4371 100644
--- a/deployments/icesat2/config/staging.yaml
+++ b/deployments/icesat2/config/staging.yaml
@@ -1,14 +1,30 @@
 # Leave commented for first build, then uncomment and add loadBalancerIP
 pangeo:
   jupyterhub:
+    hub:
+      # Reduce requests on staging hub since it is rarely used!
+      resources:
+        requests:
+          cpu: 0
+          memory: 0G
+        limits:
+          cpu: 0.5
+          memory: 1G
+      services:
+        dask-gateway:
+          # This makes the gateway available at ${HUB_URL}/services/dask-gateway
+          url: http://web-public-icesat2-staging-dask-gateway
+    singleuser:
+      extraEnv:
+        DASK_GATEWAY__ADDRESS: "http://web-public-icesat2-staging-dask-gateway/services/dask-gateway/"
+        DASK_GATEWAY__PROXY_ADDRESS: "tls://scheduler-icesat2-staging-dask-gateway:8786"
+        DASK_GATEWAY__AUTH_TYPE: "jupyterhub"
     proxy:
       https:
         hosts:
           - staging.aws-uswest2.pangeo.io
         letsencrypt:
           contactEmail: scottyh@uw.edu
-      service:
-        loadBalancerIP: a070b2175523111e9924302ea5ee1624-1148941357.us-west-2.elb.amazonaws.com
     auth:
       github:
         callbackUrl: "https://staging.aws-uswest2.pangeo.io/hub/oauth_callback"
diff --git a/deployments/icesat2/secrets/prod.yaml b/deployments/icesat2/secrets/prod.yaml
index 78a4acc3..72554415 100644
Binary files a/deployments/icesat2/secrets/prod.yaml and b/deployments/icesat2/secrets/prod.yaml differ
diff --git a/deployments/icesat2/secrets/staging.yaml b/deployments/icesat2/secrets/staging.yaml
index 3f1a766a..bac13267 100644
Binary files a/deployments/icesat2/secrets/staging.yaml and b/deployments/icesat2/secrets/staging.yaml differ
diff --git a/pangeo-deploy/values.yaml b/pangeo-deploy/values.yaml
index 201a29b1..2454e879 100644
--- a/pangeo-deploy/values.yaml
+++ b/pangeo-deploy/values.yaml
@@ -42,21 +42,23 @@ pangeo:
       clusterManager:
         image:
           name: pangeo/base-notebook
-          tag: 2019.12.24
+          tag: latest
         clusterStartTimeout: 600
         workerStartTimeout: 600
         worker:
           extraPodConfig:
             tolerations:
-              - key: "k8s.dask.org_dedicated"
+              - key: "k8s.dask.org/dedicated"
                 operator: "Equal"
                 value: "worker"
+                effect: "NoSchedule"
         scheduler:
           extraPodConfig:
             tolerations:
-              - key: "k8s.dask.org_dedicated"
+              - key: "k8s.dask.org/dedicated"
                 operator: "Equal"
-                value: "worker"
+                value: "scheduler"
+                effect: "NoSchedule"
       extraConfig:
         # Use the mapping form, to support merging multiple values.yaml
         optionHandler: |
@@ -74,7 +76,7 @@ pangeo:
           c.DaskGateway.cluster_manager_options = Options(
               Integer("worker_cores", 2, min=1, max=4, label="Worker Cores"),
               Float("worker_memory", 4, min=1, max=8, label="Worker Memory (GiB)"),
-              String("image", default="pangeo/base-notebook:2019.12.24", label="Image"),
+              String("image", default="pangeo/base-notebook:latest", label="Image"),
               handler=option_handler,
           )
 
@@ -91,4 +93,3 @@ pangeo:
 homeDirectories:
   nfs:
     enabled: false
-