diff --git a/cyberchef/Chart.yaml b/cyberchef/Chart.yaml
index fec8e6a..1639f0a 100644
--- a/cyberchef/Chart.yaml
+++ b/cyberchef/Chart.yaml
@@ -4,8 +4,8 @@ description: A Helm chart to deploy Cyberchef on Kubernetes
 
 type: application
 
-version: 4.1.0+up10.22.1
-appVersion: "10.22.1"
+version: 5.0.0+up11.4.0
+appVersion: "11.4.0"
 
 maintainers:
   - name: jklein
\ No newline at end of file
diff --git a/cyberchef/templates/cyberchef.deployment.yaml b/cyberchef/templates/cyberchef.deployment.yaml
index 70d81cc..25cb41c 100644
--- a/cyberchef/templates/cyberchef.deployment.yaml
+++ b/cyberchef/templates/cyberchef.deployment.yaml
@@ -25,14 +25,12 @@ spec:
           securityContext:
             {{- toYaml .Values.cyberchef.securityContext.container | nindent 12 }}
           volumeMounts:
-            # nginx needs writable cache/temp dirs and a writable pid file
-            # location when the root filesystem is read-only.
-            - name: nginx-cache
-              mountPath: /var/cache/nginx
-            - name: nginx-run
-              mountPath: /run
+            # nginx-unprivileged keeps its pid file and temp/cache dirs under
+            # /tmp, which needs to be writable with a read-only root filesystem.
+            - name: tmp
+              mountPath: /tmp
           ports:
-            - containerPort: 80
+            - containerPort: 8080
               protocol: TCP
               name: http
           livenessProbe:
@@ -44,8 +42,6 @@ spec:
           resources:
             {{- include "cyberchef.resources" .Values.cyberchef.resources | nindent 12 }}
       volumes:
-        - name: nginx-cache
-          emptyDir: {}
-        - name: nginx-run
+        - name: tmp
           emptyDir: {}
       restartPolicy: Always
diff --git a/cyberchef/values.yaml b/cyberchef/values.yaml
index 03f4289..188c2cd 100644
--- a/cyberchef/values.yaml
+++ b/cyberchef/values.yaml
@@ -8,18 +8,14 @@ cyberchef:
   # Replica count for this workload; 0 is allowed and scales it down.
   # The chart-global scaleDown flag takes precedence.
   replicas: 1
-  # The upstream image is stock nginx (root, listening on port 80). To still
-  # run fully non-root, the pod runs as the image's nginx user (uid 101) and
-  # the safe sysctl net.ipv4.ip_unprivileged_port_start=80 lets the unprivileged
-  # nginx bind port 80 without NET_BIND_SERVICE.
+  # Since 11.0.0 the upstream image is nginxinc/nginx-unprivileged: nginx runs
+  # as its nginx user (uid 101) and listens on the unprivileged port 8080, so
+  # no sysctl tweaks are needed to run fully non-root.
   securityContext:
     pod:
       runAsNonRoot: true
       runAsUser: 101
       runAsGroup: 101
-      sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "80"
     container:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: true