diff --git a/java/operator/org.eclipse.theia.cloud.operator/src/main/java/org/eclipse/theia/cloud/operator/TheiaCloudArguments.java b/java/operator/org.eclipse.theia.cloud.operator/src/main/java/org/eclipse/theia/cloud/operator/TheiaCloudArguments.java
index daef5989..4e96c13c 100644
--- a/java/operator/org.eclipse.theia.cloud.operator/src/main/java/org/eclipse/theia/cloud/operator/TheiaCloudArguments.java
+++ b/java/operator/org.eclipse.theia.cloud.operator/src/main/java/org/eclipse/theia/cloud/operator/TheiaCloudArguments.java
@@ -118,6 +118,10 @@ public enum BandwidthLimiter {
 	    "--continueOnException" }, description = "Whether the operator will continue to run in case of unexpected exceptions.", required = false)
     private boolean continueOnException;
 
+    @Option(names = {
+	    "--oAuth2ProxyVersion" }, description = "The version to use of the quay.io/oauth2-proxy/oauth2-proxy image.", required = false, defaultValue = "latest")
+    private String oAuth2ProxyVersion;
+
     public boolean isUseKeycloak() {
 	return useKeycloak;
     }
@@ -214,6 +218,10 @@ public boolean isContinueOnException() {
 	return continueOnException;
     }
 
+    public String getOAuth2ProxyVersion() {
+	return oAuth2ProxyVersion;
+    }
+
     @Override
     public int hashCode() {
 	final int prime = 31;
@@ -242,6 +250,7 @@ public int hashCode() {
 	result = prime * result + (useKeycloak ? 1231 : 1237);
 	result = prime * result + (usePaths ? 1231 : 1237);
 	result = prime * result + ((wondershaperImage == null) ? 0 : wondershaperImage.hashCode());
+	result = prime * result + ((oAuth2ProxyVersion == null) ? 0 : oAuth2ProxyVersion.hashCode());
 	return result;
     }
 
@@ -338,6 +347,11 @@ public boolean equals(Object obj) {
 		return false;
 	} else if (!wondershaperImage.equals(other.wondershaperImage))
 	    return false;
+	if (oAuth2ProxyVersion == null) {
+	    if (other.oAuth2ProxyVersion != null)
+		return false;
+	} else if (!oAuth2ProxyVersion.equals(other.oAuth2ProxyVersion))
+	    return false;
 	return true;
     }
 
@@ -352,7 +366,8 @@ public String toString() {
 		+ requestedStorage + ", keycloakURL=" + keycloakURL + ", keycloakRealm=" + keycloakRealm
 		+ ", keycloakClientId=" + keycloakClientId + ", leaderLeaseDuration=" + leaderLeaseDuration
 		+ ", leaderRenewDeadline=" + leaderRenewDeadline + ", leaderRetryPeriod=" + leaderRetryPeriod
-		+ ", maxWatchIdleTime=" + maxWatchIdleTime + ", continueOnException=" + continueOnException + "]";
+		+ ", maxWatchIdleTime=" + maxWatchIdleTime + ", continueOnException=" + continueOnException
+		+ ", oAuth2ProxyVersion=" + oAuth2ProxyVersion + "]";
     }
 
 }
diff --git a/java/operator/org.eclipse.theia.cloud.operator/src/main/java/org/eclipse/theia/cloud/operator/handler/impl/DefaultDeploymentTemplateReplacements.java b/java/operator/org.eclipse.theia.cloud.operator/src/main/java/org/eclipse/theia/cloud/operator/handler/impl/DefaultDeploymentTemplateReplacements.java
index e31606e8..fa7077f7 100644
--- a/java/operator/org.eclipse.theia.cloud.operator/src/main/java/org/eclipse/theia/cloud/operator/handler/impl/DefaultDeploymentTemplateReplacements.java
+++ b/java/operator/org.eclipse.theia.cloud.operator/src/main/java/org/eclipse/theia/cloud/operator/handler/impl/DefaultDeploymentTemplateReplacements.java
@@ -64,6 +64,7 @@ public class DefaultDeploymentTemplateReplacements implements DeploymentTemplate
     public static final String PLACEHOLDER_MONITOR_PORT = "placeholder-monitor-port";
     public static final String PLACEHOLDER_MONITOR_PORT_ENV = "placeholder-monitor-env-port";
     public static final String PLACEHOLDER_ENABLE_ACTIVITY_TRACKER = "placeholder-enable-activity-tracker";
+    public static final String PLACEHOLDER_OAUTH2_PROXY_VERSION = "placeholder-oauth2-proxy-version";
 
     protected static final String DEFAULT_UID = "1000";
 
@@ -80,6 +81,7 @@ public Map<String, String> getReplacements(String namespace, AppDefinition appDe
 	replacements.putAll(getAppDefinitionData(appDefinition));
 	replacements.putAll(getEnvironmentVariables(appDefinition, instance));
 	replacements.putAll(getInstanceData(appDefinition, instance));
+	replacements.put(PLACEHOLDER_OAUTH2_PROXY_VERSION, arguments.getOAuth2ProxyVersion());
 	return replacements;
     }
 
@@ -90,6 +92,7 @@ public Map<String, String> getReplacements(String namespace, AppDefinition appDe
 	replacements.putAll(getAppDefinitionData(appDefinition));
 	replacements.putAll(getEnvironmentVariables(appDefinition, session));
 	replacements.putAll(getSessionData(session));
+	replacements.put(PLACEHOLDER_OAUTH2_PROXY_VERSION, arguments.getOAuth2ProxyVersion());
 	return replacements;
     }
 
diff --git a/java/operator/org.eclipse.theia.cloud.operator/src/main/resources/templateDeployment.yaml b/java/operator/org.eclipse.theia.cloud.operator/src/main/resources/templateDeployment.yaml
index 3d55db70..9fa91edf 100644
--- a/java/operator/org.eclipse.theia.cloud.operator/src/main/resources/templateDeployment.yaml
+++ b/java/operator/org.eclipse.theia.cloud.operator/src/main/resources/templateDeployment.yaml
@@ -21,7 +21,7 @@ spec:
       automountServiceAccountToken: false
       containers:
         - name: oauth2-proxy
-          image: quay.io/oauth2-proxy/oauth2-proxy:v7.4.0
+          image: quay.io/oauth2-proxy/oauth2-proxy:placeholder-oauth2-proxy-version
           imagePullPolicy: Always
           args:
             - --config=/etc/oauth2-proxy.cfg