diff --git a/integration-tests/test_hub.py b/integration-tests/test_hub.py
index c2b1dec..9991e0c 100644
--- a/integration-tests/test_hub.py
+++ b/integration-tests/test_hub.py
@@ -31,7 +31,7 @@ def test_hub_version():
     r = requests.get(hub_url + "/hub/api")
     r.raise_for_status()
     info = r.json()
-    assert V("3.0") <= V(info["version"]) <= V("4.0")
+    assert V("4") <= V(info["version"]) <= V("5")
 
 
 @pytest.mark.asyncio
@@ -389,7 +389,9 @@ async def test_idle_server_culled():
     )
 
     async with User(username, hub_url, partial(login_dummy, password="")) as u:
+        # Login the user
         await u.login()
+
         # Start user's server
         await u.ensure_server_simulate()
         # Assert that the user exists
@@ -400,12 +402,25 @@ async def test_idle_server_culled():
         r = await u.session.get(user_url, allow_redirects=False)
         assert r.status == 200
 
+        # Extract the xsrf token from the _xsrf cookie set after visiting
+        # /hub/login with the u.session
+        hub_cookie = u.session.cookie_jar.filter_cookies(
+            str(u.hub_url / "hub/api/user")
+        )
+        assert "_xsrf" in hub_cookie
+        hub_xsrf_token = hub_cookie["_xsrf"].value
+
         # Check that we can talk to JupyterHub itself
         # use this as a proxy for whether the user still exists
         async def hub_api_request():
             r = await u.session.get(
                 u.hub_url / "hub/api/user",
-                headers={"Referer": str(u.hub_url / "hub/")},
+                headers={
+                    # Referer is needed for JupyterHub <=3
+                    "Referer": str(u.hub_url / "hub/"),
+                    # X-XSRFToken is needed for JupyterHub >=4
+                    "X-XSRFToken": hub_xsrf_token,
+                },
                 allow_redirects=False,
             )
             return r
diff --git a/tljh/installer.py b/tljh/installer.py
index 61d4d9c..4ca2470 100644
--- a/tljh/installer.py
+++ b/tljh/installer.py
@@ -123,7 +123,7 @@ def ensure_jupyterhub_package(prefix):
     conda.ensure_pip_packages(
         prefix,
         [
-            "jupyterhub==3.*",
+            "jupyterhub==4.*",
             "jupyterhub-systemdspawner==0.17.*",
             "jupyterhub-firstuseauthenticator==1.*",
             "jupyterhub-nativeauthenticator==1.*",
diff --git a/tljh/requirements-base.txt b/tljh/requirements-base.txt
index 1f59947..f926a5a 100644
--- a/tljh/requirements-base.txt
+++ b/tljh/requirements-base.txt
@@ -6,7 +6,7 @@
 #          our integration tests fail.
 #
 # JupyterHub + notebook package are base requirements for user environment
-jupyterhub==3.*
+jupyterhub==4.*
 notebook==6.*
 # Install additional notebook frontends!
 jupyterlab==3.*