diff --git a/site/config.yaml b/site/config.yaml
index 2c37f5ba1..87fa51084 100644
--- a/site/config.yaml
+++ b/site/config.yaml
@@ -7,7 +7,7 @@ params:
   github_url: "https://github.com/vmware-tanzu/pinniped"
   slack_url: "https://go.pinniped.dev/community/slack"
   community_url: "https://go.pinniped.dev/community"
-  latest_version: v0.19.0
+  latest_version: v0.20.0
   latest_codegen_version: 1.25
 pygmentsCodefences: true
 pygmentsStyle: "pygments"
diff --git a/site/content/docs/reference/cli.md b/site/content/docs/reference/cli.md
index 801a28dd1..a22eb2c05 100644
--- a/site/content/docs/reference/cli.md
+++ b/site/content/docs/reference/cli.md
@@ -194,7 +194,7 @@ pinniped get kubeconfig [flags]
       --oidc-issuer string                       OpenID Connect issuer URL (default: autodiscover)
       --oidc-listen-port uint16                  TCP port for localhost listener (authorization code flow only)
       --oidc-request-audience string             Request a token with an alternate audience using RFC8693 token exchange
-      --oidc-scopes strings                      OpenID Connect scopes to request during login (default [offline_access,openid,pinniped:request-audience])
+      --oidc-scopes strings                      OpenID Connect scopes to request during login (default [offline_access,openid,pinniped:request-audience,username,groups])
       --oidc-session-cache string                Path to OpenID Connect session cache file
       --oidc-skip-browser                        During OpenID Connect login, skip opening the browser (just print the URL)
   -o, --output string                            Output file path (default: stdout)