diff --git a/TODO b/TODO
index 0b8cfdb9..6169ed8e 100644
--- a/TODO
+++ b/TODO
@@ -31,3 +31,4 @@ reconcile system helm releases
 remove cluster and other namespace resources from apps charts, eg extension-apiserver-authentication-reader
 spawn etcd per tenant / per cluster
 add ownerReferences for tenants
+nginx-ingress has no values
diff --git a/packages/core/installer/images/installer.json b/packages/core/installer/images/installer.json
index b50b6894..ce26b2c4 100644
--- a/packages/core/installer/images/installer.json
+++ b/packages/core/installer/images/installer.json
@@ -1,14 +1,14 @@
 {
-  "containerimage.config.digest": "sha256:77ea033186d5c168113ca21b92d9f1c7ee38c1aab3e99356ec7e79ba2dda96bb",
+  "containerimage.config.digest": "sha256:908655779a8f125609aa59e58a3e40b4446115c10aa27a82d47a6bc6a5fb0731",
   "containerimage.descriptor": {
     "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-    "digest": "sha256:99b5902ce02fb7f65b49375b2c599c2868c6d789c746ea2327cb46d17bb2d09c",
+    "digest": "sha256:a5da553cb766383ca39dd1fd1c10b9dc00a8fc3cdb0cd98fc2cec7af0297b4a3",
     "size": 2074,
     "platform": {
       "architecture": "amd64",
       "os": "linux"
     }
   },
-  "containerimage.digest": "sha256:99b5902ce02fb7f65b49375b2c599c2868c6d789c746ea2327cb46d17bb2d09c",
+  "containerimage.digest": "sha256:a5da553cb766383ca39dd1fd1c10b9dc00a8fc3cdb0cd98fc2cec7af0297b4a3",
   "image.name": "ghcr.io/aenix-io/cozystack/installer:latest"
 }
\ No newline at end of file
diff --git a/packages/extra/etcd/Makefile b/packages/extra/etcd/Makefile
index 1a4a312b..d7bb46f0 100644
--- a/packages/extra/etcd/Makefile
+++ b/packages/extra/etcd/Makefile
@@ -3,3 +3,4 @@ update:
 	helm repo add clastix https://clastix.github.io/charts
 	helm repo update clastix
 	helm pull clastix/kamaji-etcd --untar --untardir charts
+	sed -i 's/hook-failed/before-hook-creation,hook-failed/' `grep -rl hook-failed charts`
diff --git a/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_postdelete.yaml b/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_postdelete.yaml
index 992eda62..71a9d5cc 100644
--- a/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_postdelete.yaml
+++ b/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_postdelete.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     "helm.sh/hook": pre-delete
     "helm.sh/hook-weight": "10"
-    "helm.sh/hook-delete-policy": "hook-succeeded,hook-failed"
+    "helm.sh/hook-delete-policy": "hook-succeeded,before-hook-creation,hook-failed"
   name: "{{ .Release.Name }}-etcd-teardown"
   namespace: {{ .Release.Namespace }}
 spec:
diff --git a/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_preinstall_1.yaml b/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_preinstall_1.yaml
index b53436d5..7fa78ce1 100644
--- a/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_preinstall_1.yaml
+++ b/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_preinstall_1.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     "helm.sh/hook": pre-install
     "helm.sh/hook-weight": "10"
-    "helm.sh/hook-delete-policy": "hook-succeeded,hook-failed"
+    "helm.sh/hook-delete-policy": "hook-succeeded,before-hook-creation,hook-failed"
   name: "{{ .Release.Name }}-etcd-setup-1"
   namespace: {{ .Release.Namespace }}
 spec:
diff --git a/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_preinstall_2.yaml b/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_preinstall_2.yaml
index 5012e5e3..be55cddc 100644
--- a/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_preinstall_2.yaml
+++ b/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_preinstall_2.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     "helm.sh/hook": post-install
     "helm.sh/hook-weight": "10"
-    "helm.sh/hook-delete-policy": "hook-succeeded,hook-failed"
+    "helm.sh/hook-delete-policy": "hook-succeeded,before-hook-creation,hook-failed"
   name: "{{ .Release.Name }}-etcd-setup-2"
   namespace: {{ .Release.Namespace }}
 spec:
diff --git a/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_s3retention.yaml b/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_s3retention.yaml
index 1dd06ada..cebe79f0 100644
--- a/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_s3retention.yaml
+++ b/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_job_s3retention.yaml
@@ -8,7 +8,7 @@ metadata:
   annotations:
     "helm.sh/hook": post-install,post-upgrade,post-rollback
     "helm.sh/hook-weight": "5"
-    "helm.sh/hook-delete-policy": "hook-succeeded,hook-failed"
+    "helm.sh/hook-delete-policy": "hook-succeeded,before-hook-creation,hook-failed"
   name: "{{ .Release.Name }}-s3-retention"
   namespace: {{ .Release.Namespace }}
 spec:
diff --git a/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_rbac.yaml b/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_rbac.yaml
index d104ffbb..bdd41be1 100644
--- a/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_rbac.yaml
+++ b/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_rbac.yaml
@@ -3,7 +3,7 @@ kind: Role
 metadata:
   annotations:
     "helm.sh/hook": pre-install,post-install,pre-delete
-    "helm.sh/hook-delete-policy": "hook-succeeded,hook-failed"
+    "helm.sh/hook-delete-policy": "hook-succeeded,before-hook-creation,hook-failed"
     "helm.sh/hook-weight": "5"
   labels:
     {{- include "etcd.labels" . | nindent 4 }}
@@ -44,7 +44,7 @@ kind: RoleBinding
 metadata:
   annotations:
     "helm.sh/hook": pre-install,post-install,pre-delete
-    "helm.sh/hook-delete-policy": "hook-succeeded,hook-failed"
+    "helm.sh/hook-delete-policy": "hook-succeeded,before-hook-creation,hook-failed"
     "helm.sh/hook-weight": "5"
   labels:
     {{- include "etcd.labels" . | nindent 4 }}
diff --git a/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_sa.yaml b/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_sa.yaml
index 3d3b45a2..99061ba7 100644
--- a/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_sa.yaml
+++ b/packages/extra/etcd/charts/kamaji-etcd/templates/etcd_sa.yaml
@@ -7,7 +7,7 @@ metadata:
     {{- include "etcd.labels" . | nindent 4 }}
   annotations:
     "helm.sh/hook": pre-install
-    "helm.sh/hook-delete-policy": "hook-failed"
+    "helm.sh/hook-delete-policy": "before-hook-creation,hook-failed"
     "helm.sh/hook-weight": "0"
   {{- with .Values.serviceAccount.annotations }}
     {{- toYaml . | nindent 4 }}
diff --git a/packages/extra/etcd/templates/datastore.yaml b/packages/extra/etcd/templates/datastore.yaml
index 7ca01e67..9ca2ffee 100644
--- a/packages/extra/etcd/templates/datastore.yaml
+++ b/packages/extra/etcd/templates/datastore.yaml
@@ -24,10 +24,10 @@ spec:
       certificate:
         secretReference:
           keyPath: tls.crt
-          name: etcd-client-certs
+          name: etcd-root-client-certs
           namespace: {{ .Release.Namespace }}
       privateKey:
         secretReference:
           keyPath: tls.key
-          name: etcd-client-certs
+          name: etcd-root-client-certs
           namespace: {{ .Release.Namespace }}