diff --git a/charts/argo/Chart.yaml b/charts/argo/Chart.yaml
index 28e783dc..de0c3833 100644
--- a/charts/argo/Chart.yaml
+++ b/charts/argo/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 appVersion: v2.8.0
 description: A Helm chart for Argo Workflows
 name: argo
-version: 0.9.7
+version: 0.9.8
 icon: https://raw.githubusercontent.com/argoproj/argo/master/docs/assets/argo.png
 home: https://github.com/argoproj/argo-helm
 maintainers:
diff --git a/charts/argo/templates/workflow-controller-config-map.yaml b/charts/argo/templates/workflow-controller-config-map.yaml
index b6d56e64..5dde9ff3 100644
--- a/charts/argo/templates/workflow-controller-config-map.yaml
+++ b/charts/argo/templates/workflow-controller-config-map.yaml
@@ -67,6 +67,6 @@ data:
     {{- if .Values.controller.workflowDefaults }}
     workflowDefaults:
 {{ toYaml .Values.controller.workflowDefaults | indent 6 }}{{- end }}
-    {{- with .Values.controller.sso }}
-    sso:
-{{ toYaml . | indent 6 }}{{- end }}
+    {{- with .Values.server.sso }}
+    sso: {{- toYaml . | nindent 6 }}
+    {{- end }}
diff --git a/charts/argo/values.yaml b/charts/argo/values.yaml
index 2525b7bd..0dc5dd47 100644
--- a/charts/argo/values.yaml
+++ b/charts/argo/values.yaml
@@ -54,7 +54,6 @@ controller:
   #     name: argo-postgres-config
   #     key: password
   workflowDefaults: {}  # Only valid for 2.7+
-  sso: {}  # Only valid for 2.9+
   #  spec:
   #    ttlStrategy:
   #      secondsAfterCompletion: 84600
@@ -202,6 +201,23 @@ server:
   clusterWorkflowTemplates:
     # Give the server permissions to edit ClusterWorkflowTemplates.
     enableEditing: true
+  sso:
+    ## SSO configuration when SSO is specified as a server auth mode.
+    ## All the values are requied. SSO is activated by adding --auth-mode=sso
+    ## to the server command line.
+    #
+    ## The root URL of the OIDC identity provider.
+    # issuer: https://accounts.google.com
+    ## Name of a secret and a key in it to retrieve the app OIDC client ID from.
+    # clientId:
+    #   name: argo-server-sso
+    #   key: client-id
+    ## Name of a secret and a key in it to retrieve the app OIDC client secret from.
+    # clientSecret:
+    #   name: argo-server-sso
+    #   key: client-secret
+    ## The OIDC redirect URL. Should be in the form <argo-root-url>/oauth2/callback.
+    # redirectUrl: https://argo/oauth2/callback
 
 # Influences the creation of the ConfigMap for the workflow-controller itself.
 useDefaultArtifactRepo: false