diff --git a/deploy/helm/aws-login/templates/aws-ecr-login-oneshot.yaml b/deploy/helm/aws-login/templates/aws-ecr-login-oneshot.yaml
index f9b5171bad..f4737396e8 100644
--- a/deploy/helm/aws-login/templates/aws-ecr-login-oneshot.yaml
+++ b/deploy/helm/aws-login/templates/aws-ecr-login-oneshot.yaml
@@ -3,6 +3,11 @@ kind: Job
 metadata:
   name: "{{ .Values.awsEcr.jobName }}"
   namespace: {{ .Release.Namespace }}
+  annotations:
+    # This is what defines this resource as a hook. Without this line, the
+    # job is considered part of the release.
+    "helm.sh/hook": post-install, post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation
 spec:
   # keep completed jobs for 24 hrs so that logs are
   # available in case of issues
diff --git a/deploy/helm/cert-proxy-client/templates/update-cert-oneshot.yaml b/deploy/helm/cert-proxy-client/templates/update-cert-oneshot.yaml
index 5a65326499..c80738d084 100644
--- a/deploy/helm/cert-proxy-client/templates/update-cert-oneshot.yaml
+++ b/deploy/helm/cert-proxy-client/templates/update-cert-oneshot.yaml
@@ -3,6 +3,11 @@ kind: Job
 metadata:
   name: update-cert-oneshot
   namespace: {{ .Release.Namespace }}
+  annotations:
+    # This is what defines this resource as a hook. Without this line, the
+    # job is considered part of the release.
+    "helm.sh/hook": post-install, post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation
 spec:
   ttlSecondsAfterFinished: 300
   template:
diff --git a/deploy/helm/create-admin-user/templates/job-create-admin-user.yaml b/deploy/helm/create-admin-user/templates/job-create-admin-user.yaml
index a3af52cd87..babf7b7021 100644
--- a/deploy/helm/create-admin-user/templates/job-create-admin-user.yaml
+++ b/deploy/helm/create-admin-user/templates/job-create-admin-user.yaml
@@ -3,6 +3,11 @@ kind: Job
 metadata:
   name: create-admin-user
   namespace: {{ .Release.Namespace }}
+  annotations:
+    # This is what defines this resource as a hook. Without this line, the
+    # job is considered part of the release.
+    "helm.sh/hook": post-install, post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation
 spec:
   ttlSecondsAfterFinished: 300
   template:
diff --git a/deploy/helm/create-admin-user/values.yaml b/deploy/helm/create-admin-user/values.yaml
index e6cdf31127..cd61cf01a7 100644
--- a/deploy/helm/create-admin-user/values.yaml
+++ b/deploy/helm/create-admin-user/values.yaml
@@ -19,6 +19,7 @@ global:
   combineSmtpPassword: "Override"
   pullSecretName: aws-login-credentials
   imageTag: "latest"
+  imagePullPolicy: IfNotPresent
   # Define the type of image registry to use, awsEcr or local
   imageRegistry: awsEcr
 
diff --git a/deploy/helm/thecombine/charts/maintenance/templates/cronjob-weekly-get-fonts.yaml b/deploy/helm/thecombine/charts/maintenance/templates/cronjob-update-fonts.yaml
similarity index 100%
rename from deploy/helm/thecombine/charts/maintenance/templates/cronjob-weekly-get-fonts.yaml
rename to deploy/helm/thecombine/charts/maintenance/templates/cronjob-update-fonts.yaml