diff --git a/helmchart/single-sign-on/templates/deployment-consent.yaml b/helmchart/single-sign-on/templates/deployment-consent.yaml
index 25999cec869cb8221b6a07059c5a18c9b71a65d0..4dfe12d3ba93860bc1fda7a23e2279b69dd0d45a 100644
--- a/helmchart/single-sign-on/templates/deployment-consent.yaml
+++ b/helmchart/single-sign-on/templates/deployment-consent.yaml
@@ -13,11 +13,13 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: {{ include "single-sign-on.name" . }}-consent
+      annotations:
+        {{- toYaml .Values.consentProvider.podAnnotations | nindent 8 }}
     spec:
       containers:
         - name: {{ .Chart.Name }}-consent
-          image: {{ .Values.consentProviderImage.repository }}:{{ .Values.consentProviderImage.tag }}
-          imagePullPolicy: {{ .Values.consentProviderImage.pullPolicy }}
+          image: {{ .Values.consentProvider.image.repository }}:{{ .Values.consentProvider.image.tag }}
+          imagePullPolicy: {{ .Values.consentProvider.image.pullPolicy }}
           env:
             - name: HYDRA_ADMIN_URL
               value: http://{{ .Release.Name }}-hydra-admin:4445
diff --git a/helmchart/single-sign-on/templates/deployment-login.yaml b/helmchart/single-sign-on/templates/deployment-login.yaml
index bdcc31b62c1a7d3bbdff5abbc0dbc14f1036894d..4776bf36f53023eaf374884f66699cb5cffccc55 100644
--- a/helmchart/single-sign-on/templates/deployment-login.yaml
+++ b/helmchart/single-sign-on/templates/deployment-login.yaml
@@ -13,11 +13,13 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: {{ include "single-sign-on.name" . }}-login
+      annotations:
+        {{- toYaml .Values.loginProvider.podAnnotations | nindent 8 }}
     spec:
       containers:
         - name: {{ .Chart.Name }}-login
-          image: {{ .Values.loginProviderImage.repository }}:{{ .Values.loginProviderImage.tag }}
-          imagePullPolicy: {{ .Values.loginProviderImage.pullPolicy }}
+          image: {{ .Values.loginProvider.image.repository }}:{{ .Values.loginProvider.image.tag }}
+          imagePullPolicy: {{ .Values.loginProvider.image.pullPolicy }}
           env:
             - name: HYDRA_ADMIN_URL
               value: http://{{ .Release.Name }}-hydra-admin:4445
diff --git a/helmchart/single-sign-on/templates/deployment-userfrontend.yaml b/helmchart/single-sign-on/templates/deployment-userfrontend.yaml
index 3fc7ea494f195d29e4e525d3097dd50dc7a4cab1..1bb6a9c6d241706db6f68495dedaaec961466c2a 100644
--- a/helmchart/single-sign-on/templates/deployment-userfrontend.yaml
+++ b/helmchart/single-sign-on/templates/deployment-userfrontend.yaml
@@ -13,6 +13,8 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: {{ include "single-sign-on.name" . }}-userpanel
+      annotations:
+        {{- toYaml .Values.userpanel.podAnnotations | nindent 8 }}
     spec:
       containers:
         - name: {{ .Chart.Name }}-userpanel
diff --git a/helmchart/single-sign-on/values.yaml b/helmchart/single-sign-on/values.yaml
index 7e04ae49d3ddfc148e36efbf527d865c33929336..2e2cf3f317db859a7a501f9c8596563f8a7e94a2 100644
--- a/helmchart/single-sign-on/values.yaml
+++ b/helmchart/single-sign-on/values.yaml
@@ -1,15 +1,19 @@
 replicaCount: 1
 
-consentProviderImage:
-  # consentProviderImage.tag and consentProviderImage.pullPolicy should be the same as
-  # loginProviderImage.tag and loginProviderImage.pullPolicy as the images are released
-  # together in order to guarantee compatibility
-  << : &IMAGE_DEFAULTS_SSO { tag: "master", pullPolicy: "Always" }
-  repository: "open.greenhost.net:4567/openappstack/single-sign-on/consent_provider"
+consentProvider:
+  image:
+    # consentProvider.image.tag and consentProvider.image.pullPolicy should be the same as
+    # loginProvider.image.tag and loginProvider.image.pullPolicy as the images are released
+    # together in order to guarantee compatibility
+    << : &IMAGE_DEFAULTS_SSO { tag: "master", pullPolicy: "Always" }
+    repository: "open.greenhost.net:4567/openappstack/single-sign-on/consent_provider"
+  podAnnotations: {}
 
-loginProviderImage:
-  << : *IMAGE_DEFAULTS_SSO
-  repository: "open.greenhost.net:4567/openappstack/single-sign-on/login_provider"
+loginProvider:
+  image:
+    << : *IMAGE_DEFAULTS_SSO
+    repository: "open.greenhost.net:4567/openappstack/single-sign-on/login_provider"
+  podAnnotations: {}
 
 # singleSignOnHost is the FQDN that will be used by the ingress to make the consent and
 # the login provider accessible by user agents. For now it is recommended to set it to the
@@ -30,6 +34,7 @@ userpanel:
   ingress:
     # userpanel.ingress.host is the FQDN of the userpanel application
     host: admin.oas.example.net
+  podAnnotations: {}
 
 userbackend:
   image: