diff --git a/k8s/README.md b/k8s/README.md
index 4200534..96a2aac 100644
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -357,7 +357,7 @@ kubectl apply $(ls octobot-fabi/*.yaml | awk ' { print " -f " $1 } ')
 ```sh
 helm repo add nextcloud https://nextcloud.github.io/helm/
 helm repo update
-helm upgrade --install nextcloud nextcloud/nextcloud -n nextcloud --version 2.14.2 -f nextcloud/nextcloud.secret.yml
+helm upgrade --install nextcloud nextcloud/nextcloud -n nextcloud --version 2.14.3 -f nextcloud/nextcloud.secret.yml
 helm upgrade --install nextcloud-phpmyadmin bitnami/phpmyadmin -n nextcloud -f nextcloud/nextcloud-phpmyadmin.yml
 ```
 
diff --git a/k8s/kube-system/metrics-server.yml b/k8s/kube-system/metrics-server.yml
index b0a0a72..9a2b6cd 100644
--- a/k8s/kube-system/metrics-server.yml
+++ b/k8s/kube-system/metrics-server.yml
@@ -33,14 +33,17 @@ metadata:
     k8s-app: metrics-server
   name: system:metrics-server
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - nodes/metrics
+  verbs:
+  - get
 - apiGroups:
   - ""
   resources:
   - pods
   - nodes
-  - nodes/stats
-  - namespaces
-  - configmaps
   verbs:
   - get
   - list
@@ -133,10 +136,11 @@ spec:
         - --secure-port=4443
         - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
         - --kubelet-use-node-status-port
+        - --metric-resolution=15s
         - --kubelet-preferred-address-types=InternalIP
         - --v=2
         - --kubelet-insecure-tls
-        image: k8s.gcr.io/metrics-server/metrics-server:v0.4.0
+        image: k8s.gcr.io/metrics-server/metrics-server:v0.6.1
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
@@ -156,8 +160,14 @@ spec:
             path: /readyz
             port: https
             scheme: HTTPS
+          initialDelaySeconds: 20
           periodSeconds: 10
+        resources:
+          requests:
+            cpu: 100m
+            memory: 200Mi
         securityContext:
+          allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000