diff --git a/docs/source/authentication.rst b/docs/source/authentication.rst
index 09ce1702b..36a39c59c 100644
--- a/docs/source/authentication.rst
+++ b/docs/source/authentication.rst
@@ -15,15 +15,15 @@ you need to add the following into ``config.yaml``:
 
     jupyterhub:
       cull:
-        # don't cull authenticated users
-        users: False
+        # don't cull authenticated users (reverts binderhub chart's default)
+        users: false
       hub:
-        redirectToServer: false
         config:
           BinderSpawner:
             auth_enabled: true
-          # specify the desired authenticator
           JupyterHub:
+            redirect_to_server: false
+            # specify the desired authenticator
             authenticator_class: <desired-authenticator>
           # use config of your authenticator here
           # use the docs at https://zero-to-jupyterhub.readthedocs.io/en/stable/authentication.html
@@ -39,10 +39,10 @@ you need to add the following into ``config.yaml``:
           user:
             scopes:
               - self
-              - "access:services"
+              - "access:services!service=binder"
 
       singleuser:
-        # to make notebook servers aware of hub
+        # make notebook servers aware of hub (reverts binderhub chart's default to z2jh chart's default)
         cmd: jupyterhub-singleuser
 
 If the configuration above was entered correctly, once you upgrade your
diff --git a/helm-chart/binderhub/values.yaml b/helm-chart/binderhub/values.yaml
index 3418c3174..e83120c39 100644
--- a/helm-chart/binderhub/values.yaml
+++ b/helm-chart/binderhub/values.yaml
@@ -81,8 +81,12 @@ jupyterhub:
           - binder
         scopes:
           - servers
-          # we don't need admin:users if auth is not enabled!
-          - "admin:users"
+          # admin:users is required in order to create a jupyterhub user for an
+          # anonymous binderhub web-server visitor in non-authenticated
+          # deployments, and read:users is required for authenticated
+          # deployments to check the state of a jupyterhub user's running
+          # servers before trying to launch.
+          - admin:users
     extraConfig:
       0-binderspawnermixin: |
         """
diff --git a/testing/local-binder-k8s-hub/jupyterhub-chart-config-auth-additions.yaml b/testing/local-binder-k8s-hub/jupyterhub-chart-config-auth-additions.yaml
index 54ce9ff67..06445c33f 100644
--- a/testing/local-binder-k8s-hub/jupyterhub-chart-config-auth-additions.yaml
+++ b/testing/local-binder-k8s-hub/jupyterhub-chart-config-auth-additions.yaml
@@ -17,4 +17,4 @@ hub:
     user:
       scopes:
         - self
-        - "access:services"
+        - "access:services!service=binder"