diff --git a/terraform/main.tf b/terraform/main.tf
index 9532a89..b379717 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -14,7 +14,9 @@ module "ssrc-jupyter-dept" {
 
   public_key_openssh = var.public_key_openssh
 
-  z2jupyterhub_version = "3.3.8"
+  z2jupyterhub_version = "3.3.8"        # https://github.com/jupyterhub/zero-to-jupyterhub-k8s/tags
+  k3s_version          = "v1.31.1+k3s1" # https://github.com/k3s-io/k3s/releases/
+  calico_version       = "v3.28.2"      # https://github.com/projectcalico/calico/releases
 
   aad_client_id     = var.aad_client_id
   aad_client_secret = var.aad_client_secret
diff --git a/terraform/modules/jupyter/README.md b/terraform/modules/jupyter/README.md
index d52639f..dbe5b55 100644
--- a/terraform/modules/jupyter/README.md
+++ b/terraform/modules/jupyter/README.md
@@ -33,8 +33,10 @@ No modules.
 | <a name="input_aad_client_id"></a> [aad\_client\_id](#input\_aad\_client\_id) | n/a | `string` | n/a | yes |
 | <a name="input_aad_client_secret"></a> [aad\_client\_secret](#input\_aad\_client\_secret) | n/a | `string` | n/a | yes |
 | <a name="input_aad_tenant_id"></a> [aad\_tenant\_id](#input\_aad\_tenant\_id) | n/a | `string` | n/a | yes |
+| <a name="input_calico_version"></a> [calico\_version](#input\_calico\_version) | Version of calico | `string` | n/a | yes |
 | <a name="input_condenser_ingress_isEnabled"></a> [condenser\_ingress\_isEnabled](#input\_condenser\_ingress\_isEnabled) | Enable web access to the server | `bool` | n/a | yes |
 | <a name="input_condenser_ingress_test_hostname"></a> [condenser\_ingress\_test\_hostname](#input\_condenser\_ingress\_test\_hostname) | Part of the URL for the web application | `string` | n/a | yes |
+| <a name="input_k3s_version"></a> [k3s\_version](#input\_k3s\_version) | Version of k3s | `string` | n/a | yes |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | Name of the SSRC namespace | `string` | n/a | yes |
 | <a name="input_network_name"></a> [network\_name](#input\_network\_name) | Name of the SSRC network | `string` | n/a | yes |
 | <a name="input_os_disk_gb"></a> [os\_disk\_gb](#input\_os\_disk\_gb) | Size of the VM's primary disk | `string` | n/a | yes |
diff --git a/terraform/modules/jupyter/cloud-init.tmpl.yml b/terraform/modules/jupyter/cloud-init.tmpl.yml
index 47891e3..af40e8c 100644
--- a/terraform/modules/jupyter/cloud-init.tmpl.yml
+++ b/terraform/modules/jupyter/cloud-init.tmpl.yml
@@ -35,6 +35,7 @@ runcmd:
     - --now
     - qemu-guest-agent.service
   - bash /tmp/install_k3s.sh
+  - bash /root/install_jupyterhub.sh
 
 ssh_authorized_keys:
 %{ for key in public_key_openssh ~}
diff --git a/terraform/modules/jupyter/install_jupyterhub.sh b/terraform/modules/jupyter/install_jupyterhub.sh
index aeb695f..87df7b2 100644
--- a/terraform/modules/jupyter/install_jupyterhub.sh
+++ b/terraform/modules/jupyter/install_jupyterhub.sh
@@ -13,3 +13,7 @@ helm upgrade --cleanup-on-fail \
   --values jupyterhub_config.yaml
 
 kubectl config set-context $(kubectl config current-context) --namespace jupyterhub
+
+# enable ingress
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/${calico_version}/manifests/tigera-operator.yaml
+kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/${calico_version}/manifests/custom-resources.yaml
diff --git a/terraform/modules/jupyter/jupyterhub_config.yaml b/terraform/modules/jupyter/jupyterhub_config.yaml
index d2721eb..b7f0a41 100644
--- a/terraform/modules/jupyter/jupyterhub_config.yaml
+++ b/terraform/modules/jupyter/jupyterhub_config.yaml
@@ -33,4 +33,4 @@ singleuser:
     tag: x86_64-ubuntu-22.04
   # `cmd: null` allows the custom CMD of the Jupyter docker-stacks to be used
   # which performs further customization on startup.
-  cmd: null
\ No newline at end of file
+  cmd: null
diff --git a/terraform/modules/jupyter/main.tf b/terraform/modules/jupyter/main.tf
index e144a17..4062cab 100644
--- a/terraform/modules/jupyter/main.tf
+++ b/terraform/modules/jupyter/main.tf
@@ -14,7 +14,12 @@ resource "harvester_cloudinit_secret" "cloud-config-jupyter" {
 
   user_data = templatefile("${path.module}/cloud-init.tmpl.yml", {
     public_key_openssh = var.public_key_openssh
-    install_k3s_script = indent(6, file("${path.module}/install_k3s.sh"))
+    install_k3s_script = indent(6, templatefile(
+      "${path.module}/install_k3s.sh",
+      {
+        k3s_version = var.k3s_version
+      }
+    ))
     jupyterhub_config = indent(6, templatefile(
       "${path.module}/jupyterhub_config.yaml",
       {
@@ -29,6 +34,7 @@ resource "harvester_cloudinit_secret" "cloud-config-jupyter" {
       "${path.module}/install_jupyterhub.sh",
       {
         z2jupyterhub_version = var.z2jupyterhub_version
+        calico_version       = var.calico_version
       }
     ))
   })
diff --git a/terraform/modules/jupyter/variables.tf b/terraform/modules/jupyter/variables.tf
index 522b31b..e0b752f 100644
--- a/terraform/modules/jupyter/variables.tf
+++ b/terraform/modules/jupyter/variables.tf
@@ -64,4 +64,14 @@ variable "aad_tenant_id" {
 variable "z2jupyterhub_version" {
   type        = string
   description = "Version of the z2jupyterhub helm chart"
-}
\ No newline at end of file
+}
+
+variable "k3s_version" {
+  type        = string
+  description = "Version of k3s"
+}
+
+variable "calico_version" {
+  type        = string
+  description = "Version of calico"
+}