diff --git a/stable/pomerium/Chart.yaml b/stable/pomerium/Chart.yaml
index 49bdb8c034..9fb1e2783d 100644
--- a/stable/pomerium/Chart.yaml
+++ b/stable/pomerium/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: pomerium
-version: 4.2.0
+version: 4.2.2
 appVersion: 0.5.2
 home: http://www.pomerium.io/
 icon: https://www.pomerium.io/logo.svg
diff --git a/stable/pomerium/README.md b/stable/pomerium/README.md
index ace00a5dcc..98a94210e6 100644
--- a/stable/pomerium/README.md
+++ b/stable/pomerium/README.md
@@ -69,18 +69,20 @@ The command removes nearly all the Kubernetes components associated with the cha
 
 In default configuration, this chart will automatically generate TLS certificates in a helm `pre-install` hook for the Pomerium services to communicate with.
 
-Upon delete, you will need to manually delete the generated secrets.  Example:
+Upon delete, you will need to manually delete the generated secrets. Example:
 
 ```console
 kubectl delete secret -l app.kubernetes.io/name=pomerium
 ```
 
-You may force recreation of your TLS certificates by setting `config.forceGenerateTLS` to `true`.  Delete any existing TLS secrets first to prevent errors, and  make sure you set back to `false` for your next helm upgrade command or your deployment will fail due to existing Secrets.
+You may force recreation of your TLS certificates by setting `config.forceGenerateTLS` to `true`. Delete any existing TLS secrets first to prevent errors, and make sure you set back to `false` for your next helm upgrade command or your deployment will fail due to existing Secrets.
 
 ### Self Provisioned
+
 If you wish to provide your own TLS certificates in secrets, you should:
-1) turn `generateTLS` to `false`
-2) specify `authenticate.existingTLSSecret`, `authorize.existingTLSSecret`, and `proxy.existingTLSSecret`, pointing at the appropriate TLS certificate for each service.
+
+1. turn `generateTLS` to `false`
+2. specify `authenticate.existingTLSSecret`, `authorize.existingTLSSecret`, and `proxy.existingTLSSecret`, pointing at the appropriate TLS certificate for each service.
 
 All services can share the secret if appropriate.
 
@@ -146,7 +148,7 @@ A full listing of Pomerium's configuration variables can be found on the [config
 | `tracing.provider`                  | Specifies the tracing provider to configure (Valid options: Jaeger)                                                                                                                                           | Required                                                                              |
 | `tracing.jaeger.collector_endpoint` | The jaeger collector endpoint                                                                                                                                                                                 | Required                                                                              |
 | `tracing.jaeger.agent_endpoint`     | The jaeger agent endpoint                                                                                                                                                                                     | Required                                                                              |
-| `ingress.enabled`                   | Enables Ingress for pomerium                                                                                                                                                                                  | `false`                                                                               |
+| `ingress.enabled`                   | Enables Ingress for pomerium                                                                                                                                                                                  | `true`                                                                               |
 | `ingress.annotations`               | Ingress annotations                                                                                                                                                                                           | `{}`                                                                                  |
 | `ingress.hosts`                     | Ingress accepted hostnames                                                                                                                                                                                    | `[]`                                                                                  |
 | `ingress.tls`                       | Ingress TLS configuration                                                                                                                                                                                     | `[]`                                                                                  |
@@ -157,22 +159,25 @@ A full listing of Pomerium's configuration variables can be found on the [config
 ## Changelog
 
 ### 4.0.0
+
 - Upgrade to Pomerium v0.4.0
 - Handle breaking changes from Pomerium
 
 ### 3.0.0
+
 - Refactor TLS certificates to use Kubernetes TLS secrets
 - Generate TLS certificates in a hook to prevent certificate churn
 
 ### 2.0.0
 
 - Expose replica count for individual services
-- Switch Authorize service to CluserIP for client side load balancing
+- Switch Authorize service to ClusterIP for client side load balancing
   - You must run pomerium v0.3.0+ to support this feature correctly
 
 ## Upgrading
 
 ### 4.0.0
+
 - There are no user facing changes in this chart release
 - See [Pomerium Changelog](https://www.pomerium.io/docs/upgrading.html#since-0-3-0) for internal details
 
@@ -194,14 +199,15 @@ A full listing of Pomerium's configuration variables can be found on the [config
     - [Move and convert your certificates](scripts/upgrade-v3.0.0.sh) to type TLS Secrets and configure `[service].existingTLSSecret` to point to your secrets
     - **OR:** To continue using your certificates from the existing config, set `config.existingLegacyTLSSecret` to `true`
 
-****
+---
+
 ### 2.0.0
 
 - You will need to run `helm upgrade --force` to recreate the authorize service correctly
 
 ## Metrics Discovery Configuration
 
-This chart provices two ways to surface metrics for discovery.  Under normal circumstances, you will only set up one method.
+This chart provides two ways to surface metrics for discovery. Under normal circumstances, you will only set up one method.
 
 ### Prometheus Operator
 
@@ -217,15 +223,14 @@ serviceMonitor:
   enabled: true
   labels:
     release: prometheus # default
-
 ```
 
 Example ServiceMonitor configuration:
 
 ```yaml
-    serviceMonitorSelector:
-      matchLabels:
-        release: prometheus # operator chart default
+serviceMonitorSelector:
+  matchLabels:
+    release: prometheus # operator chart default
 ```
 
 ### Prometheus kubernetes_sd_configs
@@ -243,6 +248,7 @@ service:
 ```
 
 Example prometheus discovery config:
+
 ```yaml
 - job_name: 'pomerium'
 metrics_path: /metrics
diff --git a/stable/pomerium/templates/authenticate-service.yaml b/stable/pomerium/templates/authenticate-service.yaml
index c99b7f18d5..8ebacb3b68 100644
--- a/stable/pomerium/templates/authenticate-service.yaml
+++ b/stable/pomerium/templates/authenticate-service.yaml
@@ -11,15 +11,17 @@ metadata:
 {{- if .Values.service.labels }}
 {{ toYaml .Values.service.labels | indent 4 }}
 {{- end }}
-annotations:
-{{- if .Values.authenticate.service.annotations }}
- {{- range $key, $value := .Values.authenticate.service.annotations }}
-   {{ $key }}: {{ $value | quote }}
- {{- end }}
-{{- else if .Values.service.annotations }}
- {{- range $key, $value := .Values.service.annotations }}
-   {{ $key }}: {{ $value | quote }}
- {{- end }}
+{{- if or .Values.authenticate.service.annotations .Values.service.annotations }}
+  annotations:
+  {{- if .Values.authenticate.service.annotations }}
+    {{- range $key, $value := .Values.authenticate.service.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+  {{- else if .Values.service.annotations }}
+    {{- range $key, $value := .Values.service.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+  {{- end }}
 {{- end }}
 spec:
   type: {{ .Values.service.type }}
diff --git a/stable/pomerium/templates/authorize-deployment.yaml b/stable/pomerium/templates/authorize-deployment.yaml
index edb3557b7a..4528e68e40 100644
--- a/stable/pomerium/templates/authorize-deployment.yaml
+++ b/stable/pomerium/templates/authorize-deployment.yaml
@@ -10,15 +10,17 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: authorize
   name: {{ template "pomerium.authorize.fullname" . }}
+{{- if or .Values.authorize.deployment.annotations .Values.annotations }}
   annotations:
- {{- if .Values.authorize.deployment.annotations }}
- {{- range $key, $value := .Values.authorize.deployment.annotations }}
-   {{ $key }}: {{ $value | quote }}
- {{- end }}
-{{- else if .Values.annotations }}
- {{- range $key, $value := .Values.annotations }}
-   {{ $key }}: {{ $value | quote }}
- {{- end }}
+  {{- if .Values.authorize.deployment.annotations }}
+    {{- range $key, $value := .Values.authorize.deployment.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+  {{- else if .Values.annotations }}
+    {{- range $key, $value := .Values.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+  {{- end }}
 {{- end }}
 spec:
   replicas: {{ default .Values.replicaCount .Values.authorize.replicaCount }}
diff --git a/stable/pomerium/templates/authorize-service.yaml b/stable/pomerium/templates/authorize-service.yaml
index d03642f91d..55600db748 100644
--- a/stable/pomerium/templates/authorize-service.yaml
+++ b/stable/pomerium/templates/authorize-service.yaml
@@ -11,15 +11,17 @@ metadata:
 {{- if .Values.service.labels }}
 {{ toYaml .Values.service.labels | indent 4 }}
 {{- end }}
-annotations:
-{{- if .Values.authorize.service.annotations }}
- {{- range $key, $value := .Values.authorize.service.annotations }}
-   {{ $key }}: {{ $value | quote }}
- {{- end }}
-{{- else if .Values.service.annotations }}
- {{- range $key, $value := .Values.service.annotations }}
-   {{ $key }}: {{ $value | quote }}
- {{- end }}
+{{- if or .Values.authorize.service.annotations .Values.service.annotations }}
+  annotations:
+  {{- if .Values.authorize.service.annotations }}
+    {{- range $key, $value := .Values.authorize.service.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+  {{- else if .Values.service.annotations }}
+    {{- range $key, $value := .Values.service.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+  {{- end }}
 {{- end }}
 spec:
 {{- if .Values.service.authorize.headless }}
diff --git a/stable/pomerium/templates/proxy-deployment.yaml b/stable/pomerium/templates/proxy-deployment.yaml
index 35a68dd950..ea1a8f9acd 100644
--- a/stable/pomerium/templates/proxy-deployment.yaml
+++ b/stable/pomerium/templates/proxy-deployment.yaml
@@ -10,15 +10,17 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: proxy
   name: {{ template "pomerium.proxy.fullname" . }}
+{{- if or .Values.proxy.deployment.annotations .Values.annotations }}
   annotations:
- {{- if .Values.proxy.deployment.annotations }}
- {{- range $key, $value := .Values.proxy.deployment.annotations }}
-   {{ $key }}: {{ $value | quote }}
- {{- end }}
-{{- else if .Values.annotations }}
- {{- range $key, $value := .Values.annotations }}
-   {{ $key }}: {{ $value | quote }}
- {{- end }}
+  {{- if .Values.proxy.deployment.annotations }}
+    {{- range $key, $value := .Values.proxy.deployment.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+  {{- else if .Values.annotations }}
+    {{- range $key, $value := .Values.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+  {{- end }}
 {{- end }}
 spec:
   replicas: {{ default .Values.replicaCount .Values.proxy.replicaCount }}
diff --git a/stable/pomerium/templates/proxy-service.yaml b/stable/pomerium/templates/proxy-service.yaml
index 4bbf58a421..179f751b4e 100644
--- a/stable/pomerium/templates/proxy-service.yaml
+++ b/stable/pomerium/templates/proxy-service.yaml
@@ -11,15 +11,17 @@ metadata:
 {{- if .Values.service.labels }}
 {{ toYaml .Values.service.labels | indent 4 }}
 {{- end }}
-annotations:
-{{- if .Values.proxy.service.annotations }}
- {{- range $key, $value := .Values.proxy.service.annotations }}
-   {{ $key }}: {{ $value | quote }}
- {{- end }}
-{{- else if .Values.service.annotations }}
- {{- range $key, $value := .Values.service.annotations }}
-   {{ $key }}: {{ $value | quote }}
- {{- end }}
+{{- if or .Values.proxy.service.annotations .Values.service.annotations }}
+  annotations:
+  {{- if .Values.proxy.service.annotations }}
+    {{- range $key, $value := .Values.proxy.service.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+  {{- else if .Values.service.annotations }}
+    {{- range $key, $value := .Values.service.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+  {{- end }}
 {{- end }}
 spec:
   type: {{ .Values.service.type }}