diff --git a/chart/values.yaml b/chart/values.yaml
index 5f3fcccee78a37adfe837daaad863b94c0f52d10..5ec927a227a555038674fd7847087873b29327ca 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -1365,7 +1365,7 @@ addons:
     git:
       repo: https://repo1.dso.mil/platform-one/big-bang/apps/security-tools/keycloak.git
       path: "./chart"
-      tag: "18.4.0-bb.0"
+      tag: "18.4.0-bb.1"
 
     database:
       # -- Hostname of a pre-existing database to use for Keycloak.
diff --git a/docs/assets/configs/example/keycloak-prod-values.yaml b/docs/assets/configs/example/keycloak-prod-values.yaml
index 0f1e80c5867d95dc009996145fba106d2339089b..1a356f9f0f90a5f4b4344be99edcdf520bccab50 100644
--- a/docs/assets/configs/example/keycloak-prod-values.yaml
+++ b/docs/assets/configs/example/keycloak-prod-values.yaml
@@ -123,12 +123,16 @@ addons:
           stringData:
             quarkus.properties: |-
               quarkus.http.non-application-root-path=/
-              quarkus.kc-routing-redirects.urls./=/auth/realms/YOUR-REALM-NAME/account
-              quarkus.kc-routing-redirects.urls./auth=/auth/realms/YOUR-REALM-NAME/account
-              quarkus.kc-routing-redirects.urls./register=/auth/realms/YOUR-REALM-NAME/protocol/openid-connect/registrations?client_id=account&response_type=code
-              quarkus.kc-routing-redirects.path-prefixes./oauth/authorize=/auth/realms/YOUR-REALM-NAME/protocol/openid-connect/auth
-              quarkus.kc-routing-redirects.path-filters./api/v4/user=/auth/realms/YOUR-REALM-NAME/protocol/openid-connect/userinfo
-              quarkus.kc-routing-redirects.path-filters./oauth/token=/auth/realms/YOUR-REALM-NAME/protocol/openid-connect/token
+              # custom redirects
+              quarkus.kc-routing.path-redirect./=/auth/realms/baby-yoda/account
+              quarkus.kc-routing.path-redirect./auth=/auth/realms/baby-yoda/account
+              quarkus.kc-routing.path-redirect./register=/auth/realms/baby-yoda/protocol/openid-connect/registrations?client_id=account&response_type=code
+              quarkus.kc-routing.path-prefix./oauth/authorize=/auth/realms/baby-yoda/protocol/openid-connect/auth
+              quarkus.kc-routing.path-filter./api/v4/user=/auth/realms/baby-yoda/protocol/openid-connect/userinfo
+              quarkus.kc-routing.path-filter./oauth/token=/auth/realms/baby-yoda/protocol/openid-connect/token
+              # block metrics and health enpoints from being exposed through the istio ingress
+              quarkus.kc-routing.path-recursive-block./metrics=8443
+              quarkus.kc-routing.path-recursive-block./health=8443
 
 
       # This config includes an example of injecting a custom theme jar on startup
diff --git a/tests/test-values.yaml b/tests/test-values.yaml
index 6d4910480479a5b4ca93cd930df80da706c46869..18e28b1577b294c1044c7ed5e5207108fd323086 100644
--- a/tests/test-values.yaml
+++ b/tests/test-values.yaml
@@ -1479,7 +1479,7 @@ addons:
             quarkus.properties: '{{ .Files.Get "resources/dev/quarkus.properties" }}'
       extraInitContainers: |-
         - name: plugin
-          image: registry1.dso.mil/ironbank/big-bang/p1-keycloak-plugin:3.0.1
+          image: registry1.dso.mil/ironbank/big-bang/p1-keycloak-plugin:3.1.0
           imagePullPolicy: Always
           command:
           - sh