diff --git a/go.mod b/go.mod
index c98d70d1..ec276810 100644
--- a/go.mod
+++ b/go.mod
@@ -3,11 +3,11 @@ module github.com/dexidp/dex
 go 1.16
 
 require (
+	entgo.io/ent v0.7.0
 	github.com/AppsFlyer/go-sundheit v0.3.1
 	github.com/beevik/etree v1.1.0
 	github.com/coreos/go-oidc/v3 v3.0.0
 	github.com/dexidp/dex/api/v2 v2.0.0
-	github.com/facebook/ent v0.5.4
 	github.com/felixge/httpsnoop v1.0.1
 	github.com/ghodss/yaml v1.0.0
 	github.com/go-ldap/ldap/v3 v3.3.0
diff --git a/storage/ent/db/authcode.go b/storage/ent/db/authcode.go
index 5ee7cea8..6b177880 100644
--- a/storage/ent/db/authcode.go
+++ b/storage/ent/db/authcode.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/authcode"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // AuthCode is the model entity for the AuthCode schema.
@@ -95,7 +95,7 @@ func (ac *AuthCode) assignValues(columns []string, values []interface{}) error {
 				return fmt.Errorf("unexpected type %T for field scopes", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &ac.Scopes); err != nil {
-					return fmt.Errorf("unmarshal field scopes: %v", err)
+					return fmt.Errorf("unmarshal field scopes: %w", err)
 				}
 			}
 		case authcode.FieldNonce:
@@ -140,7 +140,7 @@ func (ac *AuthCode) assignValues(columns []string, values []interface{}) error {
 				return fmt.Errorf("unexpected type %T for field claims_groups", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &ac.ClaimsGroups); err != nil {
-					return fmt.Errorf("unmarshal field claims_groups: %v", err)
+					return fmt.Errorf("unmarshal field claims_groups: %w", err)
 				}
 			}
 		case authcode.FieldClaimsPreferredUsername:
diff --git a/storage/ent/db/authcode/authcode.go b/storage/ent/db/authcode/authcode.go
index dfa9062b..3411f15b 100644
--- a/storage/ent/db/authcode/authcode.go
+++ b/storage/ent/db/authcode/authcode.go
@@ -37,7 +37,6 @@ const (
 	FieldCodeChallenge = "code_challenge"
 	// FieldCodeChallengeMethod holds the string denoting the code_challenge_method field in the database.
 	FieldCodeChallengeMethod = "code_challenge_method"
-
 	// Table holds the table name of the authcode in the database.
 	Table = "auth_codes"
 )
diff --git a/storage/ent/db/authcode/where.go b/storage/ent/db/authcode/where.go
index 863ffc17..0b9a37ef 100644
--- a/storage/ent/db/authcode/where.go
+++ b/storage/ent/db/authcode/where.go
@@ -5,8 +5,8 @@ package authcode
 import (
 	"time"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // ID filters vertices based on their ID field.
diff --git a/storage/ent/db/authcode_create.go b/storage/ent/db/authcode_create.go
index 1850eddf..a15e682d 100644
--- a/storage/ent/db/authcode_create.go
+++ b/storage/ent/db/authcode_create.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"time"
 
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/authcode"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // AuthCodeCreate is the builder for creating a AuthCode entity.
diff --git a/storage/ent/db/authcode_delete.go b/storage/ent/db/authcode_delete.go
index ce2b5f31..c76007b3 100644
--- a/storage/ent/db/authcode_delete.go
+++ b/storage/ent/db/authcode_delete.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/authcode"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // AuthCodeDelete is the builder for deleting a AuthCode entity.
diff --git a/storage/ent/db/authcode_query.go b/storage/ent/db/authcode_query.go
index d3a70ae7..3d2010c0 100644
--- a/storage/ent/db/authcode_query.go
+++ b/storage/ent/db/authcode_query.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/authcode"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // AuthCodeQuery is the builder for querying AuthCode entities.
@@ -261,7 +261,7 @@ func (acq *AuthCodeQuery) GroupBy(field string, fields ...string) *AuthCodeGroup
 		if err := acq.prepareQuery(ctx); err != nil {
 			return nil, err
 		}
-		return acq.sqlQuery(), nil
+		return acq.sqlQuery(ctx), nil
 	}
 	return group
 }
@@ -334,7 +334,7 @@ func (acq *AuthCodeQuery) sqlCount(ctx context.Context) (int, error) {
 func (acq *AuthCodeQuery) sqlExist(ctx context.Context) (bool, error) {
 	n, err := acq.sqlCount(ctx)
 	if err != nil {
-		return false, fmt.Errorf("db: check existence: %v", err)
+		return false, fmt.Errorf("db: check existence: %w", err)
 	}
 	return n > 0, nil
 }
@@ -384,7 +384,7 @@ func (acq *AuthCodeQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (acq *AuthCodeQuery) sqlQuery() *sql.Selector {
+func (acq *AuthCodeQuery) sqlQuery(ctx context.Context) *sql.Selector {
 	builder := sql.Dialect(acq.driver.Dialect())
 	t1 := builder.Table(authcode.Table)
 	selector := builder.Select(t1.Columns(authcode.Columns...)...).From(t1)
@@ -679,7 +679,7 @@ func (acs *AuthCodeSelect) Scan(ctx context.Context, v interface{}) error {
 	if err := acs.prepareQuery(ctx); err != nil {
 		return err
 	}
-	acs.sql = acs.AuthCodeQuery.sqlQuery()
+	acs.sql = acs.AuthCodeQuery.sqlQuery(ctx)
 	return acs.sqlScan(ctx, v)
 }
 
diff --git a/storage/ent/db/authcode_update.go b/storage/ent/db/authcode_update.go
index b14669dd..86eb8c5f 100644
--- a/storage/ent/db/authcode_update.go
+++ b/storage/ent/db/authcode_update.go
@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"time"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/authcode"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // AuthCodeUpdate is the builder for updating AuthCode entities.
@@ -670,6 +670,13 @@ func (acuo *AuthCodeUpdateOne) sqlSave(ctx context.Context) (_node *AuthCode, er
 		return nil, &ValidationError{Name: "ID", err: fmt.Errorf("missing AuthCode.ID for update")}
 	}
 	_spec.Node.ID.Value = id
+	if ps := acuo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
 	if value, ok := acuo.mutation.ClientID(); ok {
 		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
 			Type:   field.TypeString,
diff --git a/storage/ent/db/authrequest.go b/storage/ent/db/authrequest.go
index 5b686270..669185fe 100644
--- a/storage/ent/db/authrequest.go
+++ b/storage/ent/db/authrequest.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // AuthRequest is the model entity for the AuthRequest schema.
@@ -103,7 +103,7 @@ func (ar *AuthRequest) assignValues(columns []string, values []interface{}) erro
 				return fmt.Errorf("unexpected type %T for field scopes", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &ar.Scopes); err != nil {
-					return fmt.Errorf("unmarshal field scopes: %v", err)
+					return fmt.Errorf("unmarshal field scopes: %w", err)
 				}
 			}
 		case authrequest.FieldResponseTypes:
@@ -112,7 +112,7 @@ func (ar *AuthRequest) assignValues(columns []string, values []interface{}) erro
 				return fmt.Errorf("unexpected type %T for field response_types", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &ar.ResponseTypes); err != nil {
-					return fmt.Errorf("unmarshal field response_types: %v", err)
+					return fmt.Errorf("unmarshal field response_types: %w", err)
 				}
 			}
 		case authrequest.FieldRedirectURI:
@@ -175,7 +175,7 @@ func (ar *AuthRequest) assignValues(columns []string, values []interface{}) erro
 				return fmt.Errorf("unexpected type %T for field claims_groups", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &ar.ClaimsGroups); err != nil {
-					return fmt.Errorf("unmarshal field claims_groups: %v", err)
+					return fmt.Errorf("unmarshal field claims_groups: %w", err)
 				}
 			}
 		case authrequest.FieldClaimsPreferredUsername:
diff --git a/storage/ent/db/authrequest/authrequest.go b/storage/ent/db/authrequest/authrequest.go
index 125a4d59..00094a73 100644
--- a/storage/ent/db/authrequest/authrequest.go
+++ b/storage/ent/db/authrequest/authrequest.go
@@ -45,7 +45,6 @@ const (
 	FieldCodeChallenge = "code_challenge"
 	// FieldCodeChallengeMethod holds the string denoting the code_challenge_method field in the database.
 	FieldCodeChallengeMethod = "code_challenge_method"
-
 	// Table holds the table name of the authrequest in the database.
 	Table = "auth_requests"
 )
diff --git a/storage/ent/db/authrequest/where.go b/storage/ent/db/authrequest/where.go
index 998f0107..31ae7a03 100644
--- a/storage/ent/db/authrequest/where.go
+++ b/storage/ent/db/authrequest/where.go
@@ -5,8 +5,8 @@ package authrequest
 import (
 	"time"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // ID filters vertices based on their ID field.
diff --git a/storage/ent/db/authrequest_create.go b/storage/ent/db/authrequest_create.go
index 377aaf1a..e7a2c8ce 100644
--- a/storage/ent/db/authrequest_create.go
+++ b/storage/ent/db/authrequest_create.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"time"
 
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // AuthRequestCreate is the builder for creating a AuthRequest entity.
diff --git a/storage/ent/db/authrequest_delete.go b/storage/ent/db/authrequest_delete.go
index 94b0bf8a..e0d0ba66 100644
--- a/storage/ent/db/authrequest_delete.go
+++ b/storage/ent/db/authrequest_delete.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // AuthRequestDelete is the builder for deleting a AuthRequest entity.
diff --git a/storage/ent/db/authrequest_query.go b/storage/ent/db/authrequest_query.go
index 08f61835..4c4573ea 100644
--- a/storage/ent/db/authrequest_query.go
+++ b/storage/ent/db/authrequest_query.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // AuthRequestQuery is the builder for querying AuthRequest entities.
@@ -261,7 +261,7 @@ func (arq *AuthRequestQuery) GroupBy(field string, fields ...string) *AuthReques
 		if err := arq.prepareQuery(ctx); err != nil {
 			return nil, err
 		}
-		return arq.sqlQuery(), nil
+		return arq.sqlQuery(ctx), nil
 	}
 	return group
 }
@@ -334,7 +334,7 @@ func (arq *AuthRequestQuery) sqlCount(ctx context.Context) (int, error) {
 func (arq *AuthRequestQuery) sqlExist(ctx context.Context) (bool, error) {
 	n, err := arq.sqlCount(ctx)
 	if err != nil {
-		return false, fmt.Errorf("db: check existence: %v", err)
+		return false, fmt.Errorf("db: check existence: %w", err)
 	}
 	return n > 0, nil
 }
@@ -384,7 +384,7 @@ func (arq *AuthRequestQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (arq *AuthRequestQuery) sqlQuery() *sql.Selector {
+func (arq *AuthRequestQuery) sqlQuery(ctx context.Context) *sql.Selector {
 	builder := sql.Dialect(arq.driver.Dialect())
 	t1 := builder.Table(authrequest.Table)
 	selector := builder.Select(t1.Columns(authrequest.Columns...)...).From(t1)
@@ -679,7 +679,7 @@ func (ars *AuthRequestSelect) Scan(ctx context.Context, v interface{}) error {
 	if err := ars.prepareQuery(ctx); err != nil {
 		return err
 	}
-	ars.sql = ars.AuthRequestQuery.sqlQuery()
+	ars.sql = ars.AuthRequestQuery.sqlQuery(ctx)
 	return ars.sqlScan(ctx, v)
 }
 
diff --git a/storage/ent/db/authrequest_update.go b/storage/ent/db/authrequest_update.go
index d091914d..87057605 100644
--- a/storage/ent/db/authrequest_update.go
+++ b/storage/ent/db/authrequest_update.go
@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"time"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // AuthRequestUpdate is the builder for updating AuthRequest entities.
@@ -672,6 +672,13 @@ func (aruo *AuthRequestUpdateOne) sqlSave(ctx context.Context) (_node *AuthReque
 		return nil, &ValidationError{Name: "ID", err: fmt.Errorf("missing AuthRequest.ID for update")}
 	}
 	_spec.Node.ID.Value = id
+	if ps := aruo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
 	if value, ok := aruo.mutation.ClientID(); ok {
 		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
 			Type:   field.TypeString,
diff --git a/storage/ent/db/client.go b/storage/ent/db/client.go
index 9ce7d626..1cd21708 100644
--- a/storage/ent/db/client.go
+++ b/storage/ent/db/client.go
@@ -20,8 +20,8 @@ import (
 	"github.com/dexidp/dex/storage/ent/db/password"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
 
-	"github.com/facebook/ent/dialect"
-	"github.com/facebook/ent/dialect/sql"
+	"entgo.io/ent/dialect"
+	"entgo.io/ent/dialect/sql"
 )
 
 // Client is the client that holds all ent builders.
@@ -98,9 +98,10 @@ func (c *Client) Tx(ctx context.Context) (*Tx, error) {
 	}
 	tx, err := newTx(ctx, c.driver)
 	if err != nil {
-		return nil, fmt.Errorf("db: starting a transaction: %v", err)
+		return nil, fmt.Errorf("db: starting a transaction: %w", err)
 	}
-	cfg := config{driver: tx, log: c.log, debug: c.debug, hooks: c.hooks}
+	cfg := c.config
+	cfg.driver = tx
 	return &Tx{
 		ctx:            ctx,
 		config:         cfg,
@@ -122,11 +123,14 @@ func (c *Client) BeginTx(ctx context.Context, opts *sql.TxOptions) (*Tx, error)
 	if _, ok := c.driver.(*txDriver); ok {
 		return nil, fmt.Errorf("ent: cannot start a transaction within a transaction")
 	}
-	tx, err := c.driver.(*sql.Driver).BeginTx(ctx, opts)
+	tx, err := c.driver.(interface {
+		BeginTx(context.Context, *sql.TxOptions) (dialect.Tx, error)
+	}).BeginTx(ctx, opts)
 	if err != nil {
-		return nil, fmt.Errorf("ent: starting a transaction: %v", err)
+		return nil, fmt.Errorf("ent: starting a transaction: %w", err)
 	}
-	cfg := config{driver: &txDriver{tx: tx, drv: c.driver}, log: c.log, debug: c.debug, hooks: c.hooks}
+	cfg := c.config
+	cfg.driver = &txDriver{tx: tx, drv: c.driver}
 	return &Tx{
 		config:         cfg,
 		AuthCode:       NewAuthCodeClient(cfg),
@@ -153,7 +157,8 @@ func (c *Client) Debug() *Client {
 	if c.debug {
 		return c
 	}
-	cfg := config{driver: dialect.Debug(c.driver, c.log), log: c.log, debug: true, hooks: c.hooks}
+	cfg := c.config
+	cfg.driver = dialect.Debug(c.driver, c.log)
 	client := &Client{config: cfg}
 	client.init()
 	return client
diff --git a/storage/ent/db/config.go b/storage/ent/db/config.go
index 4adca118..6e1ffb6c 100644
--- a/storage/ent/db/config.go
+++ b/storage/ent/db/config.go
@@ -3,8 +3,8 @@
 package db
 
 import (
-	"github.com/facebook/ent"
-	"github.com/facebook/ent/dialect"
+	"entgo.io/ent"
+	"entgo.io/ent/dialect"
 )
 
 // Option function to configure the client.
diff --git a/storage/ent/db/connector.go b/storage/ent/db/connector.go
index 62dc71ed..94614c44 100644
--- a/storage/ent/db/connector.go
+++ b/storage/ent/db/connector.go
@@ -6,8 +6,8 @@ import (
 	"fmt"
 	"strings"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/connector"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // Connector is the model entity for the Connector schema.
diff --git a/storage/ent/db/connector/connector.go b/storage/ent/db/connector/connector.go
index cd9557c3..1ee43270 100644
--- a/storage/ent/db/connector/connector.go
+++ b/storage/ent/db/connector/connector.go
@@ -15,7 +15,6 @@ const (
 	FieldResourceVersion = "resource_version"
 	// FieldConfig holds the string denoting the config field in the database.
 	FieldConfig = "config"
-
 	// Table holds the table name of the connector in the database.
 	Table = "connectors"
 )
diff --git a/storage/ent/db/connector/where.go b/storage/ent/db/connector/where.go
index 12051370..889a6dd7 100644
--- a/storage/ent/db/connector/where.go
+++ b/storage/ent/db/connector/where.go
@@ -3,8 +3,8 @@
 package connector
 
 import (
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // ID filters vertices based on their ID field.
diff --git a/storage/ent/db/connector_create.go b/storage/ent/db/connector_create.go
index 6a640d01..eebe4d05 100644
--- a/storage/ent/db/connector_create.go
+++ b/storage/ent/db/connector_create.go
@@ -7,9 +7,9 @@ import (
 	"errors"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/connector"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // ConnectorCreate is the builder for creating a Connector entity.
diff --git a/storage/ent/db/connector_delete.go b/storage/ent/db/connector_delete.go
index 0644d27f..1368fcc1 100644
--- a/storage/ent/db/connector_delete.go
+++ b/storage/ent/db/connector_delete.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/connector"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // ConnectorDelete is the builder for deleting a Connector entity.
diff --git a/storage/ent/db/connector_query.go b/storage/ent/db/connector_query.go
index 1600893f..89d0acfb 100644
--- a/storage/ent/db/connector_query.go
+++ b/storage/ent/db/connector_query.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/connector"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // ConnectorQuery is the builder for querying Connector entities.
@@ -261,7 +261,7 @@ func (cq *ConnectorQuery) GroupBy(field string, fields ...string) *ConnectorGrou
 		if err := cq.prepareQuery(ctx); err != nil {
 			return nil, err
 		}
-		return cq.sqlQuery(), nil
+		return cq.sqlQuery(ctx), nil
 	}
 	return group
 }
@@ -334,7 +334,7 @@ func (cq *ConnectorQuery) sqlCount(ctx context.Context) (int, error) {
 func (cq *ConnectorQuery) sqlExist(ctx context.Context) (bool, error) {
 	n, err := cq.sqlCount(ctx)
 	if err != nil {
-		return false, fmt.Errorf("db: check existence: %v", err)
+		return false, fmt.Errorf("db: check existence: %w", err)
 	}
 	return n > 0, nil
 }
@@ -384,7 +384,7 @@ func (cq *ConnectorQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (cq *ConnectorQuery) sqlQuery() *sql.Selector {
+func (cq *ConnectorQuery) sqlQuery(ctx context.Context) *sql.Selector {
 	builder := sql.Dialect(cq.driver.Dialect())
 	t1 := builder.Table(connector.Table)
 	selector := builder.Select(t1.Columns(connector.Columns...)...).From(t1)
@@ -679,7 +679,7 @@ func (cs *ConnectorSelect) Scan(ctx context.Context, v interface{}) error {
 	if err := cs.prepareQuery(ctx); err != nil {
 		return err
 	}
-	cs.sql = cs.ConnectorQuery.sqlQuery()
+	cs.sql = cs.ConnectorQuery.sqlQuery(ctx)
 	return cs.sqlScan(ctx, v)
 }
 
diff --git a/storage/ent/db/connector_update.go b/storage/ent/db/connector_update.go
index 053811a4..5e53ea0b 100644
--- a/storage/ent/db/connector_update.go
+++ b/storage/ent/db/connector_update.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/connector"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // ConnectorUpdate is the builder for updating Connector entities.
@@ -308,6 +308,13 @@ func (cuo *ConnectorUpdateOne) sqlSave(ctx context.Context) (_node *Connector, e
 		return nil, &ValidationError{Name: "ID", err: fmt.Errorf("missing Connector.ID for update")}
 	}
 	_spec.Node.ID.Value = id
+	if ps := cuo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
 	if value, ok := cuo.mutation.GetType(); ok {
 		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
 			Type:   field.TypeString,
diff --git a/storage/ent/db/devicerequest.go b/storage/ent/db/devicerequest.go
index 00b2e727..d66435d5 100644
--- a/storage/ent/db/devicerequest.go
+++ b/storage/ent/db/devicerequest.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // DeviceRequest is the model entity for the DeviceRequest schema.
@@ -95,7 +95,7 @@ func (dr *DeviceRequest) assignValues(columns []string, values []interface{}) er
 				return fmt.Errorf("unexpected type %T for field scopes", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &dr.Scopes); err != nil {
-					return fmt.Errorf("unmarshal field scopes: %v", err)
+					return fmt.Errorf("unmarshal field scopes: %w", err)
 				}
 			}
 		case devicerequest.FieldExpiry:
diff --git a/storage/ent/db/devicerequest/devicerequest.go b/storage/ent/db/devicerequest/devicerequest.go
index 145f377a..487662ce 100644
--- a/storage/ent/db/devicerequest/devicerequest.go
+++ b/storage/ent/db/devicerequest/devicerequest.go
@@ -19,7 +19,6 @@ const (
 	FieldScopes = "scopes"
 	// FieldExpiry holds the string denoting the expiry field in the database.
 	FieldExpiry = "expiry"
-
 	// Table holds the table name of the devicerequest in the database.
 	Table = "device_requests"
 )
diff --git a/storage/ent/db/devicerequest/where.go b/storage/ent/db/devicerequest/where.go
index ecbe94b6..a9273bbd 100644
--- a/storage/ent/db/devicerequest/where.go
+++ b/storage/ent/db/devicerequest/where.go
@@ -5,8 +5,8 @@ package devicerequest
 import (
 	"time"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // ID filters vertices based on their ID field.
diff --git a/storage/ent/db/devicerequest_create.go b/storage/ent/db/devicerequest_create.go
index 9424ed39..70599fed 100644
--- a/storage/ent/db/devicerequest_create.go
+++ b/storage/ent/db/devicerequest_create.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"time"
 
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // DeviceRequestCreate is the builder for creating a DeviceRequest entity.
diff --git a/storage/ent/db/devicerequest_delete.go b/storage/ent/db/devicerequest_delete.go
index 063b532e..34c0b890 100644
--- a/storage/ent/db/devicerequest_delete.go
+++ b/storage/ent/db/devicerequest_delete.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // DeviceRequestDelete is the builder for deleting a DeviceRequest entity.
diff --git a/storage/ent/db/devicerequest_query.go b/storage/ent/db/devicerequest_query.go
index ca63852a..520812bd 100644
--- a/storage/ent/db/devicerequest_query.go
+++ b/storage/ent/db/devicerequest_query.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // DeviceRequestQuery is the builder for querying DeviceRequest entities.
@@ -261,7 +261,7 @@ func (drq *DeviceRequestQuery) GroupBy(field string, fields ...string) *DeviceRe
 		if err := drq.prepareQuery(ctx); err != nil {
 			return nil, err
 		}
-		return drq.sqlQuery(), nil
+		return drq.sqlQuery(ctx), nil
 	}
 	return group
 }
@@ -334,7 +334,7 @@ func (drq *DeviceRequestQuery) sqlCount(ctx context.Context) (int, error) {
 func (drq *DeviceRequestQuery) sqlExist(ctx context.Context) (bool, error) {
 	n, err := drq.sqlCount(ctx)
 	if err != nil {
-		return false, fmt.Errorf("db: check existence: %v", err)
+		return false, fmt.Errorf("db: check existence: %w", err)
 	}
 	return n > 0, nil
 }
@@ -384,7 +384,7 @@ func (drq *DeviceRequestQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (drq *DeviceRequestQuery) sqlQuery() *sql.Selector {
+func (drq *DeviceRequestQuery) sqlQuery(ctx context.Context) *sql.Selector {
 	builder := sql.Dialect(drq.driver.Dialect())
 	t1 := builder.Table(devicerequest.Table)
 	selector := builder.Select(t1.Columns(devicerequest.Columns...)...).From(t1)
@@ -679,7 +679,7 @@ func (drs *DeviceRequestSelect) Scan(ctx context.Context, v interface{}) error {
 	if err := drs.prepareQuery(ctx); err != nil {
 		return err
 	}
-	drs.sql = drs.DeviceRequestQuery.sqlQuery()
+	drs.sql = drs.DeviceRequestQuery.sqlQuery(ctx)
 	return drs.sqlScan(ctx, v)
 }
 
diff --git a/storage/ent/db/devicerequest_update.go b/storage/ent/db/devicerequest_update.go
index b0bd79dd..aba544e1 100644
--- a/storage/ent/db/devicerequest_update.go
+++ b/storage/ent/db/devicerequest_update.go
@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"time"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // DeviceRequestUpdate is the builder for updating DeviceRequest entities.
@@ -385,6 +385,13 @@ func (druo *DeviceRequestUpdateOne) sqlSave(ctx context.Context) (_node *DeviceR
 		return nil, &ValidationError{Name: "ID", err: fmt.Errorf("missing DeviceRequest.ID for update")}
 	}
 	_spec.Node.ID.Value = id
+	if ps := druo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
 	if value, ok := druo.mutation.UserCode(); ok {
 		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
 			Type:   field.TypeString,
diff --git a/storage/ent/db/devicetoken.go b/storage/ent/db/devicetoken.go
index 4534f3be..6a88b5d5 100644
--- a/storage/ent/db/devicetoken.go
+++ b/storage/ent/db/devicetoken.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/devicetoken"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // DeviceToken is the model entity for the DeviceToken schema.
diff --git a/storage/ent/db/devicetoken/devicetoken.go b/storage/ent/db/devicetoken/devicetoken.go
index 85b72381..7af65799 100644
--- a/storage/ent/db/devicetoken/devicetoken.go
+++ b/storage/ent/db/devicetoken/devicetoken.go
@@ -19,7 +19,6 @@ const (
 	FieldLastRequest = "last_request"
 	// FieldPollInterval holds the string denoting the poll_interval field in the database.
 	FieldPollInterval = "poll_interval"
-
 	// Table holds the table name of the devicetoken in the database.
 	Table = "device_tokens"
 )
diff --git a/storage/ent/db/devicetoken/where.go b/storage/ent/db/devicetoken/where.go
index 72f9a848..b22879a6 100644
--- a/storage/ent/db/devicetoken/where.go
+++ b/storage/ent/db/devicetoken/where.go
@@ -5,8 +5,8 @@ package devicetoken
 import (
 	"time"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // ID filters vertices based on their ID field.
diff --git a/storage/ent/db/devicetoken_create.go b/storage/ent/db/devicetoken_create.go
index 462f5789..50ed1aad 100644
--- a/storage/ent/db/devicetoken_create.go
+++ b/storage/ent/db/devicetoken_create.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"time"
 
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/devicetoken"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // DeviceTokenCreate is the builder for creating a DeviceToken entity.
diff --git a/storage/ent/db/devicetoken_delete.go b/storage/ent/db/devicetoken_delete.go
index 49c5dc18..0ea9069d 100644
--- a/storage/ent/db/devicetoken_delete.go
+++ b/storage/ent/db/devicetoken_delete.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/devicetoken"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // DeviceTokenDelete is the builder for deleting a DeviceToken entity.
diff --git a/storage/ent/db/devicetoken_query.go b/storage/ent/db/devicetoken_query.go
index c811ca6e..df399481 100644
--- a/storage/ent/db/devicetoken_query.go
+++ b/storage/ent/db/devicetoken_query.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/devicetoken"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // DeviceTokenQuery is the builder for querying DeviceToken entities.
@@ -261,7 +261,7 @@ func (dtq *DeviceTokenQuery) GroupBy(field string, fields ...string) *DeviceToke
 		if err := dtq.prepareQuery(ctx); err != nil {
 			return nil, err
 		}
-		return dtq.sqlQuery(), nil
+		return dtq.sqlQuery(ctx), nil
 	}
 	return group
 }
@@ -334,7 +334,7 @@ func (dtq *DeviceTokenQuery) sqlCount(ctx context.Context) (int, error) {
 func (dtq *DeviceTokenQuery) sqlExist(ctx context.Context) (bool, error) {
 	n, err := dtq.sqlCount(ctx)
 	if err != nil {
-		return false, fmt.Errorf("db: check existence: %v", err)
+		return false, fmt.Errorf("db: check existence: %w", err)
 	}
 	return n > 0, nil
 }
@@ -384,7 +384,7 @@ func (dtq *DeviceTokenQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (dtq *DeviceTokenQuery) sqlQuery() *sql.Selector {
+func (dtq *DeviceTokenQuery) sqlQuery(ctx context.Context) *sql.Selector {
 	builder := sql.Dialect(dtq.driver.Dialect())
 	t1 := builder.Table(devicetoken.Table)
 	selector := builder.Select(t1.Columns(devicetoken.Columns...)...).From(t1)
@@ -679,7 +679,7 @@ func (dts *DeviceTokenSelect) Scan(ctx context.Context, v interface{}) error {
 	if err := dts.prepareQuery(ctx); err != nil {
 		return err
 	}
-	dts.sql = dts.DeviceTokenQuery.sqlQuery()
+	dts.sql = dts.DeviceTokenQuery.sqlQuery(ctx)
 	return dts.sqlScan(ctx, v)
 }
 
diff --git a/storage/ent/db/devicetoken_update.go b/storage/ent/db/devicetoken_update.go
index 234f22fe..123b6227 100644
--- a/storage/ent/db/devicetoken_update.go
+++ b/storage/ent/db/devicetoken_update.go
@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"time"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/devicetoken"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // DeviceTokenUpdate is the builder for updating DeviceToken entities.
@@ -386,6 +386,13 @@ func (dtuo *DeviceTokenUpdateOne) sqlSave(ctx context.Context) (_node *DeviceTok
 		return nil, &ValidationError{Name: "ID", err: fmt.Errorf("missing DeviceToken.ID for update")}
 	}
 	_spec.Node.ID.Value = id
+	if ps := dtuo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
 	if value, ok := dtuo.mutation.DeviceCode(); ok {
 		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
 			Type:   field.TypeString,
diff --git a/storage/ent/db/ent.go b/storage/ent/db/ent.go
index 1c34eb98..b66677b1 100644
--- a/storage/ent/db/ent.go
+++ b/storage/ent/db/ent.go
@@ -5,12 +5,11 @@ package db
 import (
 	"errors"
 	"fmt"
-	"strings"
 
-	"github.com/facebook/ent"
-	"github.com/facebook/ent/dialect"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent"
+	"entgo.io/ent/dialect"
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
 )
 
 // ent aliases to avoid import conflicts in user's code.
@@ -238,22 +237,8 @@ func IsConstraintError(err error) bool {
 }
 
 func isSQLConstraintError(err error) (*ConstraintError, bool) {
-	var (
-		msg = err.Error()
-		// error format per dialect.
-		errors = [...]string{
-			"Error 1062",               // MySQL 1062 error (ER_DUP_ENTRY).
-			"UNIQUE constraint failed", // SQLite.
-			"duplicate key value violates unique constraint", // PostgreSQL.
-		}
-	)
-	if _, ok := err.(*sqlgraph.ConstraintError); ok {
-		return &ConstraintError{msg, err}, true
-	}
-	for i := range errors {
-		if strings.Contains(msg, errors[i]) {
-			return &ConstraintError{msg, err}, true
-		}
+	if sqlgraph.IsConstraintError(err) {
+		return &ConstraintError{err.Error(), err}, true
 	}
 	return nil, false
 }
@@ -261,7 +246,7 @@ func isSQLConstraintError(err error) (*ConstraintError, bool) {
 // rollback calls tx.Rollback and wraps the given error with the rollback error if present.
 func rollback(tx dialect.Tx, err error) error {
 	if rerr := tx.Rollback(); rerr != nil {
-		err = fmt.Errorf("%s: %v", err.Error(), rerr)
+		err = fmt.Errorf("%w: %v", err, rerr)
 	}
 	if err, ok := isSQLConstraintError(err); ok {
 		return err
diff --git a/storage/ent/db/enttest/enttest.go b/storage/ent/db/enttest/enttest.go
index 4d38ba88..7dffdd1b 100644
--- a/storage/ent/db/enttest/enttest.go
+++ b/storage/ent/db/enttest/enttest.go
@@ -9,7 +9,7 @@ import (
 	// required by schema hooks.
 	_ "github.com/dexidp/dex/storage/ent/db/runtime"
 
-	"github.com/facebook/ent/dialect/sql/schema"
+	"entgo.io/ent/dialect/sql/schema"
 )
 
 type (
diff --git a/storage/ent/db/keys.go b/storage/ent/db/keys.go
index 9d5abcfd..790e4a9a 100644
--- a/storage/ent/db/keys.go
+++ b/storage/ent/db/keys.go
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/db/keys"
-	"github.com/facebook/ent/dialect/sql"
 	"gopkg.in/square/go-jose.v2"
 )
 
@@ -67,7 +67,7 @@ func (k *Keys) assignValues(columns []string, values []interface{}) error {
 				return fmt.Errorf("unexpected type %T for field verification_keys", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &k.VerificationKeys); err != nil {
-					return fmt.Errorf("unmarshal field verification_keys: %v", err)
+					return fmt.Errorf("unmarshal field verification_keys: %w", err)
 				}
 			}
 		case keys.FieldSigningKey:
@@ -76,7 +76,7 @@ func (k *Keys) assignValues(columns []string, values []interface{}) error {
 				return fmt.Errorf("unexpected type %T for field signing_key", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &k.SigningKey); err != nil {
-					return fmt.Errorf("unmarshal field signing_key: %v", err)
+					return fmt.Errorf("unmarshal field signing_key: %w", err)
 				}
 			}
 		case keys.FieldSigningKeyPub:
@@ -85,7 +85,7 @@ func (k *Keys) assignValues(columns []string, values []interface{}) error {
 				return fmt.Errorf("unexpected type %T for field signing_key_pub", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &k.SigningKeyPub); err != nil {
-					return fmt.Errorf("unmarshal field signing_key_pub: %v", err)
+					return fmt.Errorf("unmarshal field signing_key_pub: %w", err)
 				}
 			}
 		case keys.FieldNextRotation:
diff --git a/storage/ent/db/keys/keys.go b/storage/ent/db/keys/keys.go
index bbb9844d..b877a2f6 100644
--- a/storage/ent/db/keys/keys.go
+++ b/storage/ent/db/keys/keys.go
@@ -15,7 +15,6 @@ const (
 	FieldSigningKeyPub = "signing_key_pub"
 	// FieldNextRotation holds the string denoting the next_rotation field in the database.
 	FieldNextRotation = "next_rotation"
-
 	// Table holds the table name of the keys in the database.
 	Table = "keys"
 )
diff --git a/storage/ent/db/keys/where.go b/storage/ent/db/keys/where.go
index 9cdb9b0c..55aa8ce3 100644
--- a/storage/ent/db/keys/where.go
+++ b/storage/ent/db/keys/where.go
@@ -5,8 +5,8 @@ package keys
 import (
 	"time"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // ID filters vertices based on their ID field.
diff --git a/storage/ent/db/keys_create.go b/storage/ent/db/keys_create.go
index 65b86d32..4dfae78b 100644
--- a/storage/ent/db/keys_create.go
+++ b/storage/ent/db/keys_create.go
@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"time"
 
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/db/keys"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 	"gopkg.in/square/go-jose.v2"
 )
 
diff --git a/storage/ent/db/keys_delete.go b/storage/ent/db/keys_delete.go
index 10a6c41f..620f8f10 100644
--- a/storage/ent/db/keys_delete.go
+++ b/storage/ent/db/keys_delete.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/keys"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // KeysDelete is the builder for deleting a Keys entity.
diff --git a/storage/ent/db/keys_query.go b/storage/ent/db/keys_query.go
index baea4e14..34f30d04 100644
--- a/storage/ent/db/keys_query.go
+++ b/storage/ent/db/keys_query.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/keys"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // KeysQuery is the builder for querying Keys entities.
@@ -261,7 +261,7 @@ func (kq *KeysQuery) GroupBy(field string, fields ...string) *KeysGroupBy {
 		if err := kq.prepareQuery(ctx); err != nil {
 			return nil, err
 		}
-		return kq.sqlQuery(), nil
+		return kq.sqlQuery(ctx), nil
 	}
 	return group
 }
@@ -334,7 +334,7 @@ func (kq *KeysQuery) sqlCount(ctx context.Context) (int, error) {
 func (kq *KeysQuery) sqlExist(ctx context.Context) (bool, error) {
 	n, err := kq.sqlCount(ctx)
 	if err != nil {
-		return false, fmt.Errorf("db: check existence: %v", err)
+		return false, fmt.Errorf("db: check existence: %w", err)
 	}
 	return n > 0, nil
 }
@@ -384,7 +384,7 @@ func (kq *KeysQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (kq *KeysQuery) sqlQuery() *sql.Selector {
+func (kq *KeysQuery) sqlQuery(ctx context.Context) *sql.Selector {
 	builder := sql.Dialect(kq.driver.Dialect())
 	t1 := builder.Table(keys.Table)
 	selector := builder.Select(t1.Columns(keys.Columns...)...).From(t1)
@@ -679,7 +679,7 @@ func (ks *KeysSelect) Scan(ctx context.Context, v interface{}) error {
 	if err := ks.prepareQuery(ctx); err != nil {
 		return err
 	}
-	ks.sql = ks.KeysQuery.sqlQuery()
+	ks.sql = ks.KeysQuery.sqlQuery(ctx)
 	return ks.sqlScan(ctx, v)
 }
 
diff --git a/storage/ent/db/keys_update.go b/storage/ent/db/keys_update.go
index 4b514ff8..e82c631c 100644
--- a/storage/ent/db/keys_update.go
+++ b/storage/ent/db/keys_update.go
@@ -7,12 +7,12 @@ import (
 	"fmt"
 	"time"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/db/keys"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 	"gopkg.in/square/go-jose.v2"
 )
 
@@ -269,6 +269,13 @@ func (kuo *KeysUpdateOne) sqlSave(ctx context.Context) (_node *Keys, err error)
 		return nil, &ValidationError{Name: "ID", err: fmt.Errorf("missing Keys.ID for update")}
 	}
 	_spec.Node.ID.Value = id
+	if ps := kuo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
 	if value, ok := kuo.mutation.VerificationKeys(); ok {
 		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
 			Type:   field.TypeJSON,
diff --git a/storage/ent/db/migrate/migrate.go b/storage/ent/db/migrate/migrate.go
index e9867dd1..e4a9a221 100644
--- a/storage/ent/db/migrate/migrate.go
+++ b/storage/ent/db/migrate/migrate.go
@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/facebook/ent/dialect"
-	"github.com/facebook/ent/dialect/sql/schema"
+	"entgo.io/ent/dialect"
+	"entgo.io/ent/dialect/sql/schema"
 )
 
 var (
@@ -48,7 +48,7 @@ func NewSchema(drv dialect.Driver) *Schema { return &Schema{drv: drv} }
 func (s *Schema) Create(ctx context.Context, opts ...schema.MigrateOption) error {
 	migrate, err := schema.NewMigrate(s.drv, opts...)
 	if err != nil {
-		return fmt.Errorf("ent/migrate: %v", err)
+		return fmt.Errorf("ent/migrate: %w", err)
 	}
 	return migrate.Create(ctx, Tables...)
 }
@@ -66,7 +66,7 @@ func (s *Schema) WriteTo(ctx context.Context, w io.Writer, opts ...schema.Migrat
 	}
 	migrate, err := schema.NewMigrate(drv, opts...)
 	if err != nil {
-		return fmt.Errorf("ent/migrate: %v", err)
+		return fmt.Errorf("ent/migrate: %w", err)
 	}
 	return migrate.Create(ctx, Tables...)
 }
diff --git a/storage/ent/db/migrate/schema.go b/storage/ent/db/migrate/schema.go
index f5618f57..87874137 100644
--- a/storage/ent/db/migrate/schema.go
+++ b/storage/ent/db/migrate/schema.go
@@ -3,8 +3,8 @@
 package migrate
 
 import (
-	"github.com/facebook/ent/dialect/sql/schema"
-	"github.com/facebook/ent/schema/field"
+	"entgo.io/ent/dialect/sql/schema"
+	"entgo.io/ent/schema/field"
 )
 
 var (
diff --git a/storage/ent/db/mutation.go b/storage/ent/db/mutation.go
index bff6b89f..ac72af61 100644
--- a/storage/ent/db/mutation.go
+++ b/storage/ent/db/mutation.go
@@ -22,7 +22,7 @@ import (
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
 	"gopkg.in/square/go-jose.v2"
 
-	"github.com/facebook/ent"
+	"entgo.io/ent"
 )
 
 const (
diff --git a/storage/ent/db/oauth2client.go b/storage/ent/db/oauth2client.go
index 58244cd2..c2a79713 100644
--- a/storage/ent/db/oauth2client.go
+++ b/storage/ent/db/oauth2client.go
@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"strings"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/oauth2client"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // OAuth2Client is the model entity for the OAuth2Client schema.
@@ -74,7 +74,7 @@ func (o *OAuth2Client) assignValues(columns []string, values []interface{}) erro
 				return fmt.Errorf("unexpected type %T for field redirect_uris", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &o.RedirectUris); err != nil {
-					return fmt.Errorf("unmarshal field redirect_uris: %v", err)
+					return fmt.Errorf("unmarshal field redirect_uris: %w", err)
 				}
 			}
 		case oauth2client.FieldTrustedPeers:
@@ -83,7 +83,7 @@ func (o *OAuth2Client) assignValues(columns []string, values []interface{}) erro
 				return fmt.Errorf("unexpected type %T for field trusted_peers", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &o.TrustedPeers); err != nil {
-					return fmt.Errorf("unmarshal field trusted_peers: %v", err)
+					return fmt.Errorf("unmarshal field trusted_peers: %w", err)
 				}
 			}
 		case oauth2client.FieldPublic:
diff --git a/storage/ent/db/oauth2client/oauth2client.go b/storage/ent/db/oauth2client/oauth2client.go
index 70faa601..cbfdad1d 100644
--- a/storage/ent/db/oauth2client/oauth2client.go
+++ b/storage/ent/db/oauth2client/oauth2client.go
@@ -19,7 +19,6 @@ const (
 	FieldName = "name"
 	// FieldLogoURL holds the string denoting the logo_url field in the database.
 	FieldLogoURL = "logo_url"
-
 	// Table holds the table name of the oauth2client in the database.
 	Table = "oauth2clients"
 )
diff --git a/storage/ent/db/oauth2client/where.go b/storage/ent/db/oauth2client/where.go
index e0fc25cd..b7dbf7a1 100644
--- a/storage/ent/db/oauth2client/where.go
+++ b/storage/ent/db/oauth2client/where.go
@@ -3,8 +3,8 @@
 package oauth2client
 
 import (
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // ID filters vertices based on their ID field.
diff --git a/storage/ent/db/oauth2client_create.go b/storage/ent/db/oauth2client_create.go
index b0da36df..259b9473 100644
--- a/storage/ent/db/oauth2client_create.go
+++ b/storage/ent/db/oauth2client_create.go
@@ -7,9 +7,9 @@ import (
 	"errors"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/oauth2client"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // OAuth2ClientCreate is the builder for creating a OAuth2Client entity.
diff --git a/storage/ent/db/oauth2client_delete.go b/storage/ent/db/oauth2client_delete.go
index 6ec6bcf4..ab0a45f6 100644
--- a/storage/ent/db/oauth2client_delete.go
+++ b/storage/ent/db/oauth2client_delete.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/oauth2client"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // OAuth2ClientDelete is the builder for deleting a OAuth2Client entity.
diff --git a/storage/ent/db/oauth2client_query.go b/storage/ent/db/oauth2client_query.go
index c99de269..ea9a3f33 100644
--- a/storage/ent/db/oauth2client_query.go
+++ b/storage/ent/db/oauth2client_query.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/oauth2client"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // OAuth2ClientQuery is the builder for querying OAuth2Client entities.
@@ -261,7 +261,7 @@ func (oq *OAuth2ClientQuery) GroupBy(field string, fields ...string) *OAuth2Clie
 		if err := oq.prepareQuery(ctx); err != nil {
 			return nil, err
 		}
-		return oq.sqlQuery(), nil
+		return oq.sqlQuery(ctx), nil
 	}
 	return group
 }
@@ -334,7 +334,7 @@ func (oq *OAuth2ClientQuery) sqlCount(ctx context.Context) (int, error) {
 func (oq *OAuth2ClientQuery) sqlExist(ctx context.Context) (bool, error) {
 	n, err := oq.sqlCount(ctx)
 	if err != nil {
-		return false, fmt.Errorf("db: check existence: %v", err)
+		return false, fmt.Errorf("db: check existence: %w", err)
 	}
 	return n > 0, nil
 }
@@ -384,7 +384,7 @@ func (oq *OAuth2ClientQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (oq *OAuth2ClientQuery) sqlQuery() *sql.Selector {
+func (oq *OAuth2ClientQuery) sqlQuery(ctx context.Context) *sql.Selector {
 	builder := sql.Dialect(oq.driver.Dialect())
 	t1 := builder.Table(oauth2client.Table)
 	selector := builder.Select(t1.Columns(oauth2client.Columns...)...).From(t1)
@@ -679,7 +679,7 @@ func (os *OAuth2ClientSelect) Scan(ctx context.Context, v interface{}) error {
 	if err := os.prepareQuery(ctx); err != nil {
 		return err
 	}
-	os.sql = os.OAuth2ClientQuery.sqlQuery()
+	os.sql = os.OAuth2ClientQuery.sqlQuery(ctx)
 	return os.sqlScan(ctx, v)
 }
 
diff --git a/storage/ent/db/oauth2client_update.go b/storage/ent/db/oauth2client_update.go
index e60c53e6..f1bfd681 100644
--- a/storage/ent/db/oauth2client_update.go
+++ b/storage/ent/db/oauth2client_update.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/oauth2client"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // OAuth2ClientUpdate is the builder for updating OAuth2Client entities.
@@ -392,6 +392,13 @@ func (ouo *OAuth2ClientUpdateOne) sqlSave(ctx context.Context) (_node *OAuth2Cli
 		return nil, &ValidationError{Name: "ID", err: fmt.Errorf("missing OAuth2Client.ID for update")}
 	}
 	_spec.Node.ID.Value = id
+	if ps := ouo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
 	if value, ok := ouo.mutation.Secret(); ok {
 		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
 			Type:   field.TypeString,
diff --git a/storage/ent/db/offlinesession.go b/storage/ent/db/offlinesession.go
index d995f1f1..8eba0202 100644
--- a/storage/ent/db/offlinesession.go
+++ b/storage/ent/db/offlinesession.go
@@ -6,8 +6,8 @@ import (
 	"fmt"
 	"strings"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // OfflineSession is the model entity for the OfflineSession schema.
diff --git a/storage/ent/db/offlinesession/offlinesession.go b/storage/ent/db/offlinesession/offlinesession.go
index 669fa299..df12c7f0 100644
--- a/storage/ent/db/offlinesession/offlinesession.go
+++ b/storage/ent/db/offlinesession/offlinesession.go
@@ -15,7 +15,6 @@ const (
 	FieldRefresh = "refresh"
 	// FieldConnectorData holds the string denoting the connector_data field in the database.
 	FieldConnectorData = "connector_data"
-
 	// Table holds the table name of the offlinesession in the database.
 	Table = "offline_sessions"
 )
diff --git a/storage/ent/db/offlinesession/where.go b/storage/ent/db/offlinesession/where.go
index d3fe955f..e24b9039 100644
--- a/storage/ent/db/offlinesession/where.go
+++ b/storage/ent/db/offlinesession/where.go
@@ -3,8 +3,8 @@
 package offlinesession
 
 import (
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // ID filters vertices based on their ID field.
diff --git a/storage/ent/db/offlinesession_create.go b/storage/ent/db/offlinesession_create.go
index 9dd740f9..1103e8ee 100644
--- a/storage/ent/db/offlinesession_create.go
+++ b/storage/ent/db/offlinesession_create.go
@@ -7,9 +7,9 @@ import (
 	"errors"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // OfflineSessionCreate is the builder for creating a OfflineSession entity.
diff --git a/storage/ent/db/offlinesession_delete.go b/storage/ent/db/offlinesession_delete.go
index d377a04f..8ca83378 100644
--- a/storage/ent/db/offlinesession_delete.go
+++ b/storage/ent/db/offlinesession_delete.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // OfflineSessionDelete is the builder for deleting a OfflineSession entity.
diff --git a/storage/ent/db/offlinesession_query.go b/storage/ent/db/offlinesession_query.go
index cd91fc2a..a790188c 100644
--- a/storage/ent/db/offlinesession_query.go
+++ b/storage/ent/db/offlinesession_query.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // OfflineSessionQuery is the builder for querying OfflineSession entities.
@@ -261,7 +261,7 @@ func (osq *OfflineSessionQuery) GroupBy(field string, fields ...string) *Offline
 		if err := osq.prepareQuery(ctx); err != nil {
 			return nil, err
 		}
-		return osq.sqlQuery(), nil
+		return osq.sqlQuery(ctx), nil
 	}
 	return group
 }
@@ -334,7 +334,7 @@ func (osq *OfflineSessionQuery) sqlCount(ctx context.Context) (int, error) {
 func (osq *OfflineSessionQuery) sqlExist(ctx context.Context) (bool, error) {
 	n, err := osq.sqlCount(ctx)
 	if err != nil {
-		return false, fmt.Errorf("db: check existence: %v", err)
+		return false, fmt.Errorf("db: check existence: %w", err)
 	}
 	return n > 0, nil
 }
@@ -384,7 +384,7 @@ func (osq *OfflineSessionQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (osq *OfflineSessionQuery) sqlQuery() *sql.Selector {
+func (osq *OfflineSessionQuery) sqlQuery(ctx context.Context) *sql.Selector {
 	builder := sql.Dialect(osq.driver.Dialect())
 	t1 := builder.Table(offlinesession.Table)
 	selector := builder.Select(t1.Columns(offlinesession.Columns...)...).From(t1)
@@ -679,7 +679,7 @@ func (oss *OfflineSessionSelect) Scan(ctx context.Context, v interface{}) error
 	if err := oss.prepareQuery(ctx); err != nil {
 		return err
 	}
-	oss.sql = oss.OfflineSessionQuery.sqlQuery()
+	oss.sql = oss.OfflineSessionQuery.sqlQuery(ctx)
 	return oss.sqlScan(ctx, v)
 }
 
diff --git a/storage/ent/db/offlinesession_update.go b/storage/ent/db/offlinesession_update.go
index afdfc30a..14141b47 100644
--- a/storage/ent/db/offlinesession_update.go
+++ b/storage/ent/db/offlinesession_update.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // OfflineSessionUpdate is the builder for updating OfflineSession entities.
@@ -326,6 +326,13 @@ func (osuo *OfflineSessionUpdateOne) sqlSave(ctx context.Context) (_node *Offlin
 		return nil, &ValidationError{Name: "ID", err: fmt.Errorf("missing OfflineSession.ID for update")}
 	}
 	_spec.Node.ID.Value = id
+	if ps := osuo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
 	if value, ok := osuo.mutation.UserID(); ok {
 		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
 			Type:   field.TypeString,
diff --git a/storage/ent/db/password.go b/storage/ent/db/password.go
index 1ad901dd..702f33e0 100644
--- a/storage/ent/db/password.go
+++ b/storage/ent/db/password.go
@@ -6,8 +6,8 @@ import (
 	"fmt"
 	"strings"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/password"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // Password is the model entity for the Password schema.
diff --git a/storage/ent/db/password/password.go b/storage/ent/db/password/password.go
index 8293a72c..52061b01 100644
--- a/storage/ent/db/password/password.go
+++ b/storage/ent/db/password/password.go
@@ -15,7 +15,6 @@ const (
 	FieldUsername = "username"
 	// FieldUserID holds the string denoting the user_id field in the database.
 	FieldUserID = "user_id"
-
 	// Table holds the table name of the password in the database.
 	Table = "passwords"
 )
diff --git a/storage/ent/db/password/where.go b/storage/ent/db/password/where.go
index 9c501b26..979e9aa7 100644
--- a/storage/ent/db/password/where.go
+++ b/storage/ent/db/password/where.go
@@ -3,8 +3,8 @@
 package password
 
 import (
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // ID filters vertices based on their ID field.
diff --git a/storage/ent/db/password_create.go b/storage/ent/db/password_create.go
index 736375c6..2e01f4a2 100644
--- a/storage/ent/db/password_create.go
+++ b/storage/ent/db/password_create.go
@@ -7,9 +7,9 @@ import (
 	"errors"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/password"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // PasswordCreate is the builder for creating a Password entity.
diff --git a/storage/ent/db/password_delete.go b/storage/ent/db/password_delete.go
index dbb92814..87d018fc 100644
--- a/storage/ent/db/password_delete.go
+++ b/storage/ent/db/password_delete.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/password"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // PasswordDelete is the builder for deleting a Password entity.
diff --git a/storage/ent/db/password_query.go b/storage/ent/db/password_query.go
index 7ba2373b..aafc820d 100644
--- a/storage/ent/db/password_query.go
+++ b/storage/ent/db/password_query.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/password"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // PasswordQuery is the builder for querying Password entities.
@@ -261,7 +261,7 @@ func (pq *PasswordQuery) GroupBy(field string, fields ...string) *PasswordGroupB
 		if err := pq.prepareQuery(ctx); err != nil {
 			return nil, err
 		}
-		return pq.sqlQuery(), nil
+		return pq.sqlQuery(ctx), nil
 	}
 	return group
 }
@@ -334,7 +334,7 @@ func (pq *PasswordQuery) sqlCount(ctx context.Context) (int, error) {
 func (pq *PasswordQuery) sqlExist(ctx context.Context) (bool, error) {
 	n, err := pq.sqlCount(ctx)
 	if err != nil {
-		return false, fmt.Errorf("db: check existence: %v", err)
+		return false, fmt.Errorf("db: check existence: %w", err)
 	}
 	return n > 0, nil
 }
@@ -384,7 +384,7 @@ func (pq *PasswordQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (pq *PasswordQuery) sqlQuery() *sql.Selector {
+func (pq *PasswordQuery) sqlQuery(ctx context.Context) *sql.Selector {
 	builder := sql.Dialect(pq.driver.Dialect())
 	t1 := builder.Table(password.Table)
 	selector := builder.Select(t1.Columns(password.Columns...)...).From(t1)
@@ -679,7 +679,7 @@ func (ps *PasswordSelect) Scan(ctx context.Context, v interface{}) error {
 	if err := ps.prepareQuery(ctx); err != nil {
 		return err
 	}
-	ps.sql = ps.PasswordQuery.sqlQuery()
+	ps.sql = ps.PasswordQuery.sqlQuery(ctx)
 	return ps.sqlScan(ctx, v)
 }
 
diff --git a/storage/ent/db/password_update.go b/storage/ent/db/password_update.go
index 4ce36da4..f89e2334 100644
--- a/storage/ent/db/password_update.go
+++ b/storage/ent/db/password_update.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/password"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // PasswordUpdate is the builder for updating Password entities.
@@ -318,6 +318,13 @@ func (puo *PasswordUpdateOne) sqlSave(ctx context.Context) (_node *Password, err
 		return nil, &ValidationError{Name: "ID", err: fmt.Errorf("missing Password.ID for update")}
 	}
 	_spec.Node.ID.Value = id
+	if ps := puo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
 	if value, ok := puo.mutation.Email(); ok {
 		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
 			Type:   field.TypeString,
diff --git a/storage/ent/db/predicate/predicate.go b/storage/ent/db/predicate/predicate.go
index d1744792..68270087 100644
--- a/storage/ent/db/predicate/predicate.go
+++ b/storage/ent/db/predicate/predicate.go
@@ -3,7 +3,7 @@
 package predicate
 
 import (
-	"github.com/facebook/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql"
 )
 
 // AuthCode is the predicate function for authcode builders.
diff --git a/storage/ent/db/refreshtoken.go b/storage/ent/db/refreshtoken.go
index 9ce87717..057be8d6 100644
--- a/storage/ent/db/refreshtoken.go
+++ b/storage/ent/db/refreshtoken.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // RefreshToken is the model entity for the RefreshToken schema.
@@ -93,7 +93,7 @@ func (rt *RefreshToken) assignValues(columns []string, values []interface{}) err
 				return fmt.Errorf("unexpected type %T for field scopes", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &rt.Scopes); err != nil {
-					return fmt.Errorf("unmarshal field scopes: %v", err)
+					return fmt.Errorf("unmarshal field scopes: %w", err)
 				}
 			}
 		case refreshtoken.FieldNonce:
@@ -132,7 +132,7 @@ func (rt *RefreshToken) assignValues(columns []string, values []interface{}) err
 				return fmt.Errorf("unexpected type %T for field claims_groups", values[i])
 			} else if value != nil && len(*value) > 0 {
 				if err := json.Unmarshal(*value, &rt.ClaimsGroups); err != nil {
-					return fmt.Errorf("unmarshal field claims_groups: %v", err)
+					return fmt.Errorf("unmarshal field claims_groups: %w", err)
 				}
 			}
 		case refreshtoken.FieldClaimsPreferredUsername:
diff --git a/storage/ent/db/refreshtoken/refreshtoken.go b/storage/ent/db/refreshtoken/refreshtoken.go
index 89b1161f..0e28ef67 100644
--- a/storage/ent/db/refreshtoken/refreshtoken.go
+++ b/storage/ent/db/refreshtoken/refreshtoken.go
@@ -39,7 +39,6 @@ const (
 	FieldCreatedAt = "created_at"
 	// FieldLastUsed holds the string denoting the last_used field in the database.
 	FieldLastUsed = "last_used"
-
 	// Table holds the table name of the refreshtoken in the database.
 	Table = "refresh_tokens"
 )
diff --git a/storage/ent/db/refreshtoken/where.go b/storage/ent/db/refreshtoken/where.go
index fffa50c2..0acde92f 100644
--- a/storage/ent/db/refreshtoken/where.go
+++ b/storage/ent/db/refreshtoken/where.go
@@ -5,8 +5,8 @@ package refreshtoken
 import (
 	"time"
 
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	"github.com/facebook/ent/dialect/sql"
 )
 
 // ID filters vertices based on their ID field.
diff --git a/storage/ent/db/refreshtoken_create.go b/storage/ent/db/refreshtoken_create.go
index 490f1401..4035b110 100644
--- a/storage/ent/db/refreshtoken_create.go
+++ b/storage/ent/db/refreshtoken_create.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"time"
 
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // RefreshTokenCreate is the builder for creating a RefreshToken entity.
diff --git a/storage/ent/db/refreshtoken_delete.go b/storage/ent/db/refreshtoken_delete.go
index 5f625d43..34671548 100644
--- a/storage/ent/db/refreshtoken_delete.go
+++ b/storage/ent/db/refreshtoken_delete.go
@@ -6,11 +6,11 @@ import (
 	"context"
 	"fmt"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // RefreshTokenDelete is the builder for deleting a RefreshToken entity.
diff --git a/storage/ent/db/refreshtoken_query.go b/storage/ent/db/refreshtoken_query.go
index 00b16459..14fa475d 100644
--- a/storage/ent/db/refreshtoken_query.go
+++ b/storage/ent/db/refreshtoken_query.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // RefreshTokenQuery is the builder for querying RefreshToken entities.
@@ -261,7 +261,7 @@ func (rtq *RefreshTokenQuery) GroupBy(field string, fields ...string) *RefreshTo
 		if err := rtq.prepareQuery(ctx); err != nil {
 			return nil, err
 		}
-		return rtq.sqlQuery(), nil
+		return rtq.sqlQuery(ctx), nil
 	}
 	return group
 }
@@ -334,7 +334,7 @@ func (rtq *RefreshTokenQuery) sqlCount(ctx context.Context) (int, error) {
 func (rtq *RefreshTokenQuery) sqlExist(ctx context.Context) (bool, error) {
 	n, err := rtq.sqlCount(ctx)
 	if err != nil {
-		return false, fmt.Errorf("db: check existence: %v", err)
+		return false, fmt.Errorf("db: check existence: %w", err)
 	}
 	return n > 0, nil
 }
@@ -384,7 +384,7 @@ func (rtq *RefreshTokenQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (rtq *RefreshTokenQuery) sqlQuery() *sql.Selector {
+func (rtq *RefreshTokenQuery) sqlQuery(ctx context.Context) *sql.Selector {
 	builder := sql.Dialect(rtq.driver.Dialect())
 	t1 := builder.Table(refreshtoken.Table)
 	selector := builder.Select(t1.Columns(refreshtoken.Columns...)...).From(t1)
@@ -679,7 +679,7 @@ func (rts *RefreshTokenSelect) Scan(ctx context.Context, v interface{}) error {
 	if err := rts.prepareQuery(ctx); err != nil {
 		return err
 	}
-	rts.sql = rts.RefreshTokenQuery.sqlQuery()
+	rts.sql = rts.RefreshTokenQuery.sqlQuery(ctx)
 	return rts.sqlScan(ctx, v)
 }
 
diff --git a/storage/ent/db/refreshtoken_update.go b/storage/ent/db/refreshtoken_update.go
index 36493790..5c745192 100644
--- a/storage/ent/db/refreshtoken_update.go
+++ b/storage/ent/db/refreshtoken_update.go
@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"time"
 
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
-	"github.com/facebook/ent/dialect/sql"
-	"github.com/facebook/ent/dialect/sql/sqlgraph"
-	"github.com/facebook/ent/schema/field"
 )
 
 // RefreshTokenUpdate is the builder for updating RefreshToken entities.
@@ -657,6 +657,13 @@ func (rtuo *RefreshTokenUpdateOne) sqlSave(ctx context.Context) (_node *RefreshT
 		return nil, &ValidationError{Name: "ID", err: fmt.Errorf("missing RefreshToken.ID for update")}
 	}
 	_spec.Node.ID.Value = id
+	if ps := rtuo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
 	if value, ok := rtuo.mutation.ClientID(); ok {
 		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
 			Type:   field.TypeString,
diff --git a/storage/ent/db/runtime/runtime.go b/storage/ent/db/runtime/runtime.go
index 6c9133f7..2a1016b1 100644
--- a/storage/ent/db/runtime/runtime.go
+++ b/storage/ent/db/runtime/runtime.go
@@ -5,6 +5,6 @@ package runtime
 // The schema-stitching logic is generated in github.com/dexidp/dex/storage/ent/db/runtime.go
 
 const (
-	Version = "v0.5.4"                                          // Version of ent codegen.
-	Sum     = "h1:kIf2BQUdRJ7XrlTXzCyJCg69ar1K1FjFR2UQWRo/M8M=" // Sum of ent codegen.
+	Version = "v0.7.0"                                          // Version of ent codegen.
+	Sum     = "h1:E3EjO0cUL61DvUg5ZEZdxa4yTL+4SuZv0LqBExo8CQA=" // Sum of ent codegen.
 )
diff --git a/storage/ent/db/tx.go b/storage/ent/db/tx.go
index 910bbf4d..5b1f7f16 100644
--- a/storage/ent/db/tx.go
+++ b/storage/ent/db/tx.go
@@ -6,7 +6,7 @@ import (
 	"context"
 	"sync"
 
-	"github.com/facebook/ent/dialect"
+	"entgo.io/ent/dialect"
 )
 
 // Tx is a transactional client that is created by calling Client.Tx().
diff --git a/storage/ent/generate.go b/storage/ent/generate.go
index 4813a6da..805e8cdb 100644
--- a/storage/ent/generate.go
+++ b/storage/ent/generate.go
@@ -1,3 +1,3 @@
 package ent
 
-//go:generate go run github.com/facebook/ent/cmd/entc generate ./schema --target ./db
+//go:generate go run -mod=mod entgo.io/ent/cmd/ent generate ./schema --target ./db
diff --git a/storage/ent/schema/authcode.go b/storage/ent/schema/authcode.go
index fea075c9..1c7cdf59 100644
--- a/storage/ent/schema/authcode.go
+++ b/storage/ent/schema/authcode.go
@@ -1,8 +1,8 @@
 package schema
 
 import (
-	"github.com/facebook/ent"
-	"github.com/facebook/ent/schema/field"
+	"entgo.io/ent"
+	"entgo.io/ent/schema/field"
 )
 
 /* Original SQL table:
diff --git a/storage/ent/schema/authrequest.go b/storage/ent/schema/authrequest.go
index f027c1a5..a16fe551 100644
--- a/storage/ent/schema/authrequest.go
+++ b/storage/ent/schema/authrequest.go
@@ -1,8 +1,8 @@
 package schema
 
 import (
-	"github.com/facebook/ent"
-	"github.com/facebook/ent/schema/field"
+	"entgo.io/ent"
+	"entgo.io/ent/schema/field"
 )
 
 /* Original SQL table:
diff --git a/storage/ent/schema/client.go b/storage/ent/schema/client.go
index 85ea57b6..f00e84e5 100644
--- a/storage/ent/schema/client.go
+++ b/storage/ent/schema/client.go
@@ -1,8 +1,8 @@
 package schema
 
 import (
-	"github.com/facebook/ent"
-	"github.com/facebook/ent/schema/field"
+	"entgo.io/ent"
+	"entgo.io/ent/schema/field"
 )
 
 /* Original SQL table:
diff --git a/storage/ent/schema/connector.go b/storage/ent/schema/connector.go
index 4b5a6fb3..436762e2 100644
--- a/storage/ent/schema/connector.go
+++ b/storage/ent/schema/connector.go
@@ -1,8 +1,8 @@
 package schema
 
 import (
-	"github.com/facebook/ent"
-	"github.com/facebook/ent/schema/field"
+	"entgo.io/ent"
+	"entgo.io/ent/schema/field"
 )
 
 /* Original SQL table:
diff --git a/storage/ent/schema/devicerequest.go b/storage/ent/schema/devicerequest.go
index 71701e7f..99931d5b 100644
--- a/storage/ent/schema/devicerequest.go
+++ b/storage/ent/schema/devicerequest.go
@@ -1,8 +1,8 @@
 package schema
 
 import (
-	"github.com/facebook/ent"
-	"github.com/facebook/ent/schema/field"
+	"entgo.io/ent"
+	"entgo.io/ent/schema/field"
 )
 
 /* Original SQL table:
diff --git a/storage/ent/schema/devicetoken.go b/storage/ent/schema/devicetoken.go
index 1b6eadaf..f944051f 100644
--- a/storage/ent/schema/devicetoken.go
+++ b/storage/ent/schema/devicetoken.go
@@ -1,8 +1,8 @@
 package schema
 
 import (
-	"github.com/facebook/ent"
-	"github.com/facebook/ent/schema/field"
+	"entgo.io/ent"
+	"entgo.io/ent/schema/field"
 )
 
 /* Original SQL table:
diff --git a/storage/ent/schema/keys.go b/storage/ent/schema/keys.go
index 3d9e7ff6..58481edb 100644
--- a/storage/ent/schema/keys.go
+++ b/storage/ent/schema/keys.go
@@ -1,8 +1,8 @@
 package schema
 
 import (
-	"github.com/facebook/ent"
-	"github.com/facebook/ent/schema/field"
+	"entgo.io/ent"
+	"entgo.io/ent/schema/field"
 	"gopkg.in/square/go-jose.v2"
 
 	"github.com/dexidp/dex/storage"
diff --git a/storage/ent/schema/offlinesession.go b/storage/ent/schema/offlinesession.go
index 16b764d5..e9a166c3 100644
--- a/storage/ent/schema/offlinesession.go
+++ b/storage/ent/schema/offlinesession.go
@@ -1,8 +1,8 @@
 package schema
 
 import (
-	"github.com/facebook/ent"
-	"github.com/facebook/ent/schema/field"
+	"entgo.io/ent"
+	"entgo.io/ent/schema/field"
 )
 
 /* Original SQL table:
diff --git a/storage/ent/schema/password.go b/storage/ent/schema/password.go
index 378d88d3..cbc72fc5 100644
--- a/storage/ent/schema/password.go
+++ b/storage/ent/schema/password.go
@@ -1,8 +1,8 @@
 package schema
 
 import (
-	"github.com/facebook/ent"
-	"github.com/facebook/ent/schema/field"
+	"entgo.io/ent"
+	"entgo.io/ent/schema/field"
 )
 
 /* Original SQL table:
diff --git a/storage/ent/schema/refreshtoken.go b/storage/ent/schema/refreshtoken.go
index 36804ac9..4df128db 100644
--- a/storage/ent/schema/refreshtoken.go
+++ b/storage/ent/schema/refreshtoken.go
@@ -3,8 +3,8 @@ package schema
 import (
 	"time"
 
-	"github.com/facebook/ent"
-	"github.com/facebook/ent/schema/field"
+	"entgo.io/ent"
+	"entgo.io/ent/schema/field"
 )
 
 /* Original SQL table:
diff --git a/storage/ent/schema/types.go b/storage/ent/schema/types.go
index 2b0378d8..f22b71d1 100644
--- a/storage/ent/schema/types.go
+++ b/storage/ent/schema/types.go
@@ -1,7 +1,7 @@
 package schema
 
 import (
-	"github.com/facebook/ent/dialect"
+	"entgo.io/ent/dialect"
 )
 
 var textSchema = map[string]string{
diff --git a/storage/ent/sqlite.go b/storage/ent/sqlite.go
index 68601a1a..e6c43cd9 100644
--- a/storage/ent/sqlite.go
+++ b/storage/ent/sqlite.go
@@ -5,7 +5,7 @@ import (
 	"crypto/sha256"
 	"strings"
 
-	"github.com/facebook/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql"
 
 	// Register sqlite driver.
 	_ "github.com/mattn/go-sqlite3"