diff --git a/sky/common/Chart.yaml b/sky/common/Chart.yaml
index 3fa65db..8a2881c 100644
--- a/sky/common/Chart.yaml
+++ b/sky/common/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: common
 description: Common Helm chart for Kubernetes
 type: application
-version: 1.0.19
+version: 1.0.20
 appVersion: "v0.1.0"
diff --git a/sky/common/templates/jobs.yaml b/sky/common/templates/jobs.yaml
index ae7775a..f83adf7 100644
--- a/sky/common/templates/jobs.yaml
+++ b/sky/common/templates/jobs.yaml
@@ -17,6 +17,7 @@ metadata:
 spec:
   template:
     spec:
+      serviceAccountName: {{ include "common.fullname" $ }}
       containers:
       - name: {{ .name }}
         {{- if and (.image).tag .image.repository }}
diff --git a/sky/common/templates/serviceaccount.yaml b/sky/common/templates/serviceaccount.yaml
index 2d180fc..26fd9b8 100644
--- a/sky/common/templates/serviceaccount.yaml
+++ b/sky/common/templates/serviceaccount.yaml
@@ -2,9 +2,17 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "common.fullname" . }}
-  labels:
-    {{- include "common.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
   annotations:
+    # Created in PreSync (wave -3, before PreSync hook Jobs such as db-migrate /
+    # collectstatic at -1) so that on a fresh namespace the hook pods can run
+    # under this SA — which carries the workload's IRSA / EKS Pod Identity —
+    # instead of the credential-less `default` SA. hook-delete-policy is
+    # BeforeHookCreation; the identity is bound by SA name, so recreate is safe.
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    argocd.argoproj.io/sync-wave: "-3"
+    {{- with .Values.serviceAccount.annotations }}
     {{- toYaml . | nindent 4 }}
-  {{- end }}
+    {{- end }}
+  labels:
+    {{- include "common.labels" . | nindent 4 }}