diff --git a/deployment/kubernetes/templates/jupyterhub.yaml b/deployment/kubernetes/templates/jupyterhub.yaml
index bf41538..69bdeda 100644
--- a/deployment/kubernetes/templates/jupyterhub.yaml
+++ b/deployment/kubernetes/templates/jupyterhub.yaml
@@ -236,6 +236,14 @@ spec:
                 secretKeyRef:
                   name: jupyterhub-crypt
                   key: crypt-key
+            # The hub database lives on jupyterhub-claim0, so user servers can
+            # keep running while the hub restarts. Older hub images ignore it.
+            - name: JUPYTERHUB_CLEANUP_SERVERS
+              value: "false"
+            - name: JUPYTERHUB_CULL_IDLE_TIMEOUT
+              value: {{ default 0 $jupyterHub.cullIdleTimeout | quote }}
+            - name: JUPYTERHUB_CULL_EVERY
+              value: {{ default 600 $jupyterHub.cullEvery | quote }}
           volumeMounts:
             - name: jupyterhub-claim0
               mountPath: /srv/jupyterhub
diff --git a/deployment/kubernetes/values.yaml b/deployment/kubernetes/values.yaml
index 37136cf..bd63174 100644
--- a/deployment/kubernetes/values.yaml
+++ b/deployment/kubernetes/values.yaml
@@ -86,6 +86,10 @@ jupyterhub:
   codex:
     baseUrl: ""
     model: ""
+  # Stop notebooks idle this many seconds (0 = never), checked every cullEvery
+  # seconds. User files stay on their volume. Older hub images ignore both.
+  cullIdleTimeout: 3600
+  cullEvery: 600
   singleuser:
     image:
       repository: hbpmip/mip-jupyter