diff --git a/docs/migrations.md b/docs/migrations.md
index bba90bc3..989c265d 100644
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -11,7 +11,8 @@ SPDX-License-Identifier: Apache-2.0
 * [Releases upgrade details](#releases-upgrade-details)
   * [From v1.0.0](#from-v100)
     * [Pre-upgrade: Manual checks/steps](#pre-upgrade-manual-checkssteps)
-      * [Streamlining `openxchange` and `oxAppSuite` attribute names.](#streamlining-openxchange-and-oxappsuite-attribute-names)
+      * [New default enforces login](#new-default-enforces-login)
+      * [Streamlining `openxchange` and `oxAppSuite` attribute names](#streamlining-openxchange-and-oxappsuite-attribute-names)
       * [Dicts to define `customization.release`](#dicts-to-define-customizationrelease)
       * [Redis 7.4](#redis-74)
   * [From v0.9.0](#from-v090)
@@ -68,7 +69,19 @@ Explanation of the table's columns:
 
 ### Pre-upgrade: Manual checks/steps
 
-#### Streamlining `openxchange` and `oxAppSuite` attribute names.
+#### New default enforces login
+
+Users accessing the openDesk portal are now automatically redirected to the login screen as a default.
+
+In case you want to keep the previous behavior you need to set the following `functional` flag:
+
+```yaml
+functional:
+  portal:
+    enforceLogin: false
+```
+
+#### Streamlining `openxchange` and `oxAppSuite` attribute names
 
 We have updated some attribute names around Open-Xchange / OX App Suite to be consistent within our Helmfile
 deployment and to aligning with the actual brand names as well as with our rule of thumb for brand based
@@ -135,7 +148,7 @@ NOW: secrets.oxAppSuite: ...
 
 If you make use of the `customization.release` option, you have to switch to a dictionary based definition of customization files e.g. from
 
-```
+```yaml
 customization:
   release:
     collaboraOnline: "./my_custom_templating.yaml"
@@ -143,7 +156,7 @@ customization:
 
 to
 
-```
+```yaml
 customization:
   release:
     collaboraOnline:
diff --git a/helmfile/apps/nubus/values-nubus.yaml.gotmpl b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
index ff6ef3f8..e52c3e5b 100644
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -401,6 +401,7 @@ nubusStackDataUms:
   templateContext:
     # creates the default.user and default.admin
     loadDevData: true
+    portalEnforceLogin: {{ .Values.functional.portal.enforceLogin }}
     portalHeaderLogo: {{ toYaml .Values.theme.imagery.logoHeaderSvgB64 | quote }}
     portalTiles: {{ toYaml .Values.theme.imagery.portalTiles | nindent 6 }}
     portalRealtimeCollaborationLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.element .Values.global.domain }}
diff --git a/helmfile/environments/default/functional.yaml b/helmfile/environments/default/functional.yaml
index 35b30138..815b0e17 100644
--- a/helmfile/environments/default/functional.yaml
+++ b/helmfile/environments/default/functional.yaml
@@ -87,6 +87,10 @@ functional:
       # Ref.:
       enabled: false
 
+  portal:
+    # Configure if the a re-direct to the login dialogue is enforced, or if the portal is shown and the user as to actively
+    # trigger the login flow, e.g. but clicking on the "Login" portal tile.
+    enforceLogin: true
   chat:
     matrix:
       profile:
diff --git a/helmfile/environments/default/images.yaml b/helmfile/environments/default/images.yaml
index c204f034..e556e5d3 100644
--- a/helmfile/environments/default/images.yaml
+++ b/helmfile/environments/default/images.yaml
@@ -411,7 +411,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
-    tag: "1.7.5@sha256:cc38d339abea18dc3644b7764d7be13798956161d1c87e34b26b5d8b7a11edc6"
+    tag: "1.8.1@sha256:8101e27a930cb2252914440680f16eb4bb395cb89b630a251e91b7301e0f7d41"
   nubusOpenPolicyAgent:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -459,7 +459,7 @@ images:
     # upstreamRepository: "nubus/images/portal-frontend"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus-portal-update"
-    tag: "1.8.1@sha256:dd2c8e16b57d5b2a97f465b15e108231782e3ee2df1cc07cee0388459bf40e1c"
+    tag: "1.10.5@sha256:75461683a2233c2e5c99499791ceb576b717c68baa28eef2c307e7052aaaf754"
   nubusPortalServer:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"