diff --git a/modules/ory/oathkeeper/access-rule-oathkeeper.yaml b/default-access-rules.yaml
similarity index 100%
rename from modules/ory/oathkeeper/access-rule-oathkeeper.yaml
rename to default-access-rules.yaml
diff --git a/main.tf b/main.tf
index 9ef7eb14..1837fa3f 100644
--- a/main.tf
+++ b/main.tf
@@ -205,6 +205,10 @@ resource "kubernetes_namespace" "ory_namespace" {
   }
 }
 
+locals {
+  default_access_rules = yamldecode("default-access-rules")
+}
+
 module "ory" {
   count = var.enable_ory_authentication ? 1 : 0
   source = "./modules/ory"
@@ -223,9 +227,11 @@ module "ory" {
   smtp_from_address = var.smtp_from_address
 
   access_rules_path = var.access_rules_path
+  access_rules = concat(local.default_access_rules, var.ory_additional_access_rules)
+  configuration_overrides = var.ory_configuration_overrides
 }
 
 module "k8s_tools" {
   source = "./modules/k8s_tools"
   install_metrics_server = var.install_metrics_server
-}
\ No newline at end of file
+}
diff --git a/modules/ory/oathkeeper/config-oathkeeper.yaml b/modules/ory/oathkeeper/config-oathkeeper.yaml
index e4180126..a4fbce0f 100644
--- a/modules/ory/oathkeeper/config-oathkeeper.yaml
+++ b/modules/ory/oathkeeper/config-oathkeeper.yaml
@@ -1,4 +1,3 @@
----
 log:
   # Set a lower level when running in production
   level: debug
@@ -108,4 +107,3 @@ mutators:
         {
           "session": {{ .Extra | toJson }}
         }
----
\ No newline at end of file
diff --git a/modules/ory/oathkeeper/main.tf b/modules/ory/oathkeeper/main.tf
index 88330d34..10c58fdf 100644
--- a/modules/ory/oathkeeper/main.tf
+++ b/modules/ory/oathkeeper/main.tf
@@ -2,34 +2,45 @@ locals {
   config_mount_path = "/etc/config"
   secrets_mount_path = "/etc/secrets"
   access_rules_path = "${path.module}/access-rule-oathkeeper.yaml"
-}
-
-data "template_file" "oathkeeper-access-rules"{
-  template = file("%{if var.access_rules_path == null}${path.module}/access-rule-oathkeeper.yaml%{else}${var.access_rules_path}%{ endif }")
-  vars = {
-    hostname = var.hostname
-    enable_registration = var.enable_registration
+  configuration_defaults = yamldecode(file("config-oathkeeper.yaml"))
+  configuration_default_overrides = {
+    errors={
+      handlers={
+        redirect={
+          config={
+            to="${var.protocol}://${var.hostname}/profile/auth/login"
+          }
+        }
+      }
+    }
+    mutators={
+      id_token={
+        config={
+          issuer_url="${var.protocol}://${var.hostname}"
+          jwk_urls="file://${local.secrets_mount_path}/id_token.jwks.json"
+        }
+      }
+    }
   }
 }
 
-data "template_file" "oathkeeper-config"{
-  template = file("${path.module}/config-oathkeeper.yaml")
-  vars = {
-    hostname = var.hostname
-    protocol = var.protocol
-    config_path = local.config_mount_path
-    secret_path = local.secrets_mount_path
-  }
+locals {
+  configuration = merge(
+    local.configuration_defaults,  # lowest precedence
+    var.configuration_overrides,
+    local.configuration_default_overrides  # highest precedence
+  )
 }
 
+
 resource "kubernetes_config_map" "oathkeeper-configs" {
   metadata {
     name = "oathkeeper-config"
     namespace = var.namespace
   }
   data = {
-    "access-rule-oathkeeper.yaml" = data.template_file.oathkeeper-access-rules.rendered
-    "config-oathkeeper.yaml" = data.template_file.oathkeeper-config.rendered
+    "access-rule-oathkeeper.yaml" = yamlencode(var.access_rules)
+    "config-oathkeeper.yaml" = yamlencode(local.configuration)
   }
 }
 
diff --git a/modules/ory/oathkeeper/variables.tf b/modules/ory/oathkeeper/variables.tf
index def4356c..32ce521f 100644
--- a/modules/ory/oathkeeper/variables.tf
+++ b/modules/ory/oathkeeper/variables.tf
@@ -10,6 +10,34 @@ variable "protocol" {
   default = "http"
 }
 
+variable "configuration_overrides" {
+  description="Additional overrides should follow the config structure as specified here: https://www.ory.sh/oathkeeper/docs/reference/configuration/"
+  default={}
+}
+
+variable "access_rules" {
+  description = "Access rules"
+  type=list(object({
+    id=string
+    match=object({
+      url = string
+      methods = list(string)
+    })
+    authenticators = list(object({
+      handler = string
+    }))
+    authorizer=object({
+      handler=string
+    })
+    mutators = list(object({
+      handler = string
+    }))
+    credential_issuer=object({
+      handler=string
+    })
+  }))
+}
+
 variable "enable_registration" {
   description = "Bool to set if registration page will or not be visible to users"
   type = bool
@@ -18,4 +46,4 @@ variable "enable_registration" {
 variable "access_rules_path" {
     type = string
     default = null
-}
\ No newline at end of file
+}
diff --git a/modules/ory/variables.tf b/modules/ory/variables.tf
index 10cd41fe..f11b54e5 100644
--- a/modules/ory/variables.tf
+++ b/modules/ory/variables.tf
@@ -11,6 +11,34 @@ variable "protocol" {
   default = "http"
 }
 
+variable "configuration_overrides" {
+  description="Additional overrides should follow the config structure as specified here: https://www.ory.sh/oathkeeper/docs/reference/configuration/"
+  default={}
+}
+
+variable "access_rules" {
+  description = "Access rules"
+  type=list(object({
+    id=string
+    match=object({
+      url = string
+      methods = list(string)
+    })
+    authenticators = list(object({
+      handler = string
+    }))
+    authorizer=object({
+      handler=string
+    })
+    mutators = list(object({
+      handler = string
+    }))
+    credential_issuer=object({
+      handler=string
+    })
+  }))
+}
+
 // KRATOS
 variable "kratos_db_password"{
   description = "PostgreSQL Database Password"
@@ -69,4 +97,4 @@ variable "oauth2_providers" {
 variable "access_rules_path" {
   type = string
   default = null
-}
\ No newline at end of file
+}
diff --git a/variables.tf b/variables.tf
index 656b4d80..3a2e9c67 100644
--- a/variables.tf
+++ b/variables.tf
@@ -231,6 +231,34 @@ variable "ory_kratos_cookie_secret" {
   sensitive = true
 }
 
+variable "ory_configuration_overrides" {
+  description="Additional overrides should follow the config structure as specified here: https://www.ory.sh/oathkeeper/docs/reference/configuration/"
+  default={}
+}
+
+variable "ory_additional_access_rules" {
+  description = "Additional access rules. Will be merged with access rules for OML services."
+  type=list(object({
+    id=string
+    match=object({
+      url = string
+      methods = list(string)
+    })
+    authenticators = list(object({
+      handler = string
+    }))
+    authorizer=object({
+      handler=string
+    })
+    mutators = list(object({
+      handler = string
+    }))
+    credential_issuer=object({
+      handler=string
+    })
+  }))
+}
+
 variable "oauth2_providers" {
   //  Configure multiple Oauth2 providers.
   //  example: