diff --git a/helmchart/single-sign-on/requirements.yaml b/helmchart/single-sign-on/requirements.yaml
index f96d2123baaaad2af7ae9bfe6e6063ce09d72178..d336dc94cf20e7867b1290a07ae7cebfce786776 100644
--- a/helmchart/single-sign-on/requirements.yaml
+++ b/helmchart/single-sign-on/requirements.yaml
@@ -1,7 +1,7 @@
 # https://k8s.ory.sh/helm/hydra.html
 dependencies:
   - name: hydra
-    version: 0.19.5
+    version: 0.20.2
     repository: "https://k8s.ory.sh/helm/charts"
     tags:
       - single-sign-on
diff --git a/helmchart/single-sign-on/templates/job-migration.yaml b/helmchart/single-sign-on/templates/job-migration.yaml
index 0d2a03cafcc2b77e684aaa37495dbc48cfe6ccb9..2a6d47856d06c1cf06aef58bb0d665ebb2c6f0dd 100644
--- a/helmchart/single-sign-on/templates/job-migration.yaml
+++ b/helmchart/single-sign-on/templates/job-migration.yaml
@@ -12,9 +12,11 @@ metadata:
     {{- with .Values.kratos.job.annotations }}
       {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- if not .Release.IsInstall }}
     helm.sh/hook-weight: "1"
-    helm.sh/hook: "post-install, post-upgrade"
+    helm.sh/hook: "pre-upgrade"
     helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
+    {{- end }}
 spec:
   template:
     {{- with .Values.kratos.job.annotations }}
diff --git a/helmchart/single-sign-on/values.yaml b/helmchart/single-sign-on/values.yaml
index a7ab017b0ac5bafb486bc17edfd8b927034f63b8..fa8c849127c2cf0c17323f3c124265afba6b6cc7 100644
--- a/helmchart/single-sign-on/values.yaml
+++ b/helmchart/single-sign-on/values.yaml
@@ -174,6 +174,9 @@ kratos:
           connection_uri: smtps://username:password@smtp.example.com:456/
 
 hydra:
+  # Fix for this issue: https://github.com/ory/k8s/issues/367
+  image:
+    tag: v1.10.5-sqlite
   maester:
     # hydra.maester.enabled instal hydra-maester which is enabled by default
     # oauth client management is handled via jobs right now so there is no need to it