diff --git a/install.sh b/install.sh
index 4e98c6e..27596f0 100755
--- a/install.sh
+++ b/install.sh
@@ -102,6 +102,7 @@ curl --fail --silent --show-error --location --output "$chart_archive" \
 printf '%s  %s\n' "$chart_sha256" "$chart_archive" | sha256sum --check >&2
 helm upgrade --install --namespace authentik authentik "$chart_archive" \
   --version "$chart_version" --values "$project_dir/values.yaml" \
+  --take-ownership --force-conflicts --rollback-on-failure \
   --wait --timeout 15m
 kubectl apply --filename "$project_dir/authentik-outpost-path.yaml"
 kubectl apply --filename "$project_dir/authentik-media-redirect.yaml"
diff --git a/values.yaml b/values.yaml
index c8fbae2..94845e8 100644
--- a/values.yaml
+++ b/values.yaml
@@ -127,6 +127,9 @@ additionalObjects:
               authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
               invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
               client_type: confidential
+              grant_types:
+                - authorization_code
+                - refresh_token
               client_id: argocd
               client_secret: !Env ARGOCD_OIDC_CLIENT_SECRET
               issuer_mode: per_provider