diff --git a/Dockerfile b/Dockerfile
index 782bb3d..bb65355 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,9 +7,9 @@ RUN unset MAVEN_CONFIG && \
     ./mvnw versions:set -DnewVersion=LATEST && \
     ./mvnw install && \
     ./mvnw clean compile package && \
-    wget -O keycloak-rest-provider.jar https://github.com/toddkazakov/keycloak-user-migration/releases/download/v1.1/keycloak-rest-provider.jar && \
-    wget -O keycloak-metrics-spi.jar https://github.com/toddkazakov/keycloak-metrics-spi/releases/download/2.5.4-20.0.1/keycloak-metrics-spi-2.5.4.jar && \
-    wget -O keycloak-home-idp-discovery.jar https://github.com/toddkazakov/keycloak-home-idp-discovery/releases/download/0.3.0/keycloak-home-idp-discovery.jar    
+    wget -O keycloak-rest-provider.jar https://github.com/toddkazakov/keycloak-user-migration/releases/download/v2.0/keycloak-rest-provider.jar && \
+    wget -O keycloak-metrics-spi.jar https://github.com/aerogear/keycloak-metrics-spi/releases/download/3.0.0/keycloak-metrics-spi-3.0.0.jar && \
+    wget -O keycloak-home-idp-discovery.jar https://github.com/toddkazakov/keycloak-home-idp-discovery/releases/download/v21.3.2/keycloak-home-idp-discovery.jar
 
 FROM alpine:3.15 as release
 
diff --git a/Makefile b/Makefile
index 50e28c1..2edb51b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-keycloak_version = 20.0.1
+keycloak_version = 21.1.1
 date = $(shell date -u +"%Y-%m-%dT%H-%M-%S")
 image_tag = $(keycloak_version)-$(date)
 
diff --git a/admin/pom.xml b/admin/pom.xml
index 41de484..e20604d 100644
--- a/admin/pom.xml
+++ b/admin/pom.xml
@@ -24,7 +24,7 @@
         <maven.compiler.target>11</maven.compiler.target>
 
         <!-- https://mvnrepository.com/artifact/org.keycloak/keycloak-parent -->
-        <keycloak.version>20.0.1</keycloak.version>
+        <keycloak.version>21.1.1</keycloak.version>
         <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-compiler-plugin -->
         <maven-compiler-plugin.version>3.8.1</maven-compiler-plugin.version>
     </properties>
diff --git a/docker-compose.yml b/docker-compose.yml
index c2b0584..86519a5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -27,7 +27,7 @@ services:
       - providers:/providers
 
   keycloak:
-    image: quay.io/keycloak/keycloak:20.0.1
+    image: quay.io/keycloak/keycloak:21.1.1
     container_name: tp-keycloak
     environment:
       KC_DB: postgres
diff --git a/tidepool-theme/login/login-idp-link-confirm.ftl b/tidepool-theme/login/login-idp-link-confirm.ftl
index 127dea9..eb244b5 100644
--- a/tidepool-theme/login/login-idp-link-confirm.ftl
+++ b/tidepool-theme/login/login-idp-link-confirm.ftl
@@ -19,7 +19,7 @@
                            id="username"
                            class="${properties.kcInputClass!}"
                            type="text" autocomplete="off"
-                           value="${brokerContext.username}"
+                           value="${brokerContext.modelUsername}"
                     />
                 </div>
             </div>
diff --git a/tidepool-theme/login/login.ftl b/tidepool-theme/login/login.ftl
index b0c39a3..a10973c 100644
--- a/tidepool-theme/login/login.ftl
+++ b/tidepool-theme/login/login.ftl
@@ -9,8 +9,7 @@
             <form id="kc-form-login" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post">
                 <#if !usernameHidden??>
                     <div class="${properties.kcFormGroupClass!}">
-                        <label for="username"
-                               class="${properties.kcLabelClass!}"><#if !realm.loginWithEmailAllowed>${msg("username")}<#elseif !realm.registrationEmailAsUsername>${msg("usernameOrEmail")}<#else>${msg("email")}</#if></label>
+                        <label for="username" class="${properties.kcLabelClass!}"><#if !realm.loginWithEmailAllowed>${msg("username")}<#elseif !realm.registrationEmailAsUsername>${msg("usernameOrEmail")}<#else>${msg("email")}</#if></label>
 
                         <input tabindex="1" id="username" class="${properties.kcInputClass!}" name="username" value="${(login.username!'')}"  type="text" autofocus autocomplete="off"
                                aria-invalid="<#if messagesPerField.existsError('username','password')>true</#if>"
@@ -27,8 +26,7 @@
                 </#if>
 
                 <div class="${properties.kcFormGroupClass!}">
-                    <label for="password"
-                         class="${properties.kcLabelClass!}">${msg("password")}</label>
+                    <label for="password" class="${properties.kcLabelClass!}">${msg("password")}</label>
 
                     <input tabindex="2" id="password" class="${properties.kcInputClass!}" name="password" type="password" autocomplete="off"
                            aria-invalid="<#if messagesPerField.existsError('username','password')>true</#if>"