diff --git a/cmd/k8s-operator/deploy/chart/templates/deployment.yaml b/cmd/k8s-operator/deploy/chart/templates/deployment.yaml
index 034391068..3b16afabb 100644
--- a/cmd/k8s-operator/deploy/chart/templates/deployment.yaml
+++ b/cmd/k8s-operator/deploy/chart/templates/deployment.yaml
@@ -54,7 +54,7 @@ spec:
           {{- if .Values.operatorConfig.port.enabled }}
           ports:
             - containerPort: {{ .Values.operatorConfig.port.containerPort }}
-              protocol: TCP
+              protocol: UDP
           {{- end }}
           {{- with .Values.operatorConfig.resources }}
           resources:
@@ -81,7 +81,7 @@ spec:
             - name: CLIENT_SECRET_FILE
               value: /oauth/client_secret
             {{- if .Values.operatorConfig.port.enabled }}
-            - name: PORT
+            - name: TS_PORT
               value: {{ .Values.operatorConfig.port.containerPort | quote }}
             {{- end }}
             {{- $proxyTag := printf ":%s" ( .Values.proxyConfig.image.tag | default .Chart.AppVersion )}}
diff --git a/cmd/k8s-operator/deploy/chart/values.yaml b/cmd/k8s-operator/deploy/chart/values.yaml
index 29777809d..3b1c99c3b 100644
--- a/cmd/k8s-operator/deploy/chart/values.yaml
+++ b/cmd/k8s-operator/deploy/chart/values.yaml
@@ -37,7 +37,7 @@ operatorConfig:
   defaultTags:
     - "tag:k8s-operator"
 
-  # Manual configuration of Tailscaled port
+  # Manual configuration of tsnet port. If unset, a random port is selected.
   port:
     enabled: false
     containerPort: 8080