diff --git a/storage/ent/db/authcode.go b/storage/ent/db/authcode.go
index b08516d6ea..841d0b8b3f 100644
--- a/storage/ent/db/authcode.go
+++ b/storage/ent/db/authcode.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/authcode"
 )
@@ -47,6 +48,7 @@ type AuthCode struct {
 	CodeChallenge string `json:"code_challenge,omitempty"`
 	// CodeChallengeMethod holds the value of the "code_challenge_method" field.
 	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
+	selectValues        sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
@@ -63,7 +65,7 @@ func (*AuthCode) scanValues(columns []string) ([]any, error) {
 		case authcode.FieldExpiry:
 			values[i] = new(sql.NullTime)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type AuthCode", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -177,11 +179,19 @@ func (ac *AuthCode) assignValues(columns []string, values []any) error {
 			} else if value.Valid {
 				ac.CodeChallengeMethod = value.String
 			}
+		default:
+			ac.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the AuthCode.
+// This includes values selected through modifiers, order, etc.
+func (ac *AuthCode) Value(name string) (ent.Value, error) {
+	return ac.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this AuthCode.
 // Note that you need to call AuthCode.Unwrap() before calling this method if this AuthCode
 // was returned from a transaction, and the transaction was committed or rolled back.
diff --git a/storage/ent/db/authcode/authcode.go b/storage/ent/db/authcode/authcode.go
index b78eb97027..6e056f159c 100644
--- a/storage/ent/db/authcode/authcode.go
+++ b/storage/ent/db/authcode/authcode.go
@@ -2,6 +2,10 @@
 
 package authcode
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the authcode type in the database.
 	Label = "auth_code"
@@ -95,3 +99,71 @@ var (
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the AuthCode queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByClientID orders the results by the client_id field.
+func ByClientID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClientID, opts...).ToFunc()
+}
+
+// ByNonce orders the results by the nonce field.
+func ByNonce(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldNonce, opts...).ToFunc()
+}
+
+// ByRedirectURI orders the results by the redirect_uri field.
+func ByRedirectURI(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldRedirectURI, opts...).ToFunc()
+}
+
+// ByClaimsUserID orders the results by the claims_user_id field.
+func ByClaimsUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUserID, opts...).ToFunc()
+}
+
+// ByClaimsUsername orders the results by the claims_username field.
+func ByClaimsUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUsername, opts...).ToFunc()
+}
+
+// ByClaimsEmail orders the results by the claims_email field.
+func ByClaimsEmail(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmail, opts...).ToFunc()
+}
+
+// ByClaimsEmailVerified orders the results by the claims_email_verified field.
+func ByClaimsEmailVerified(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmailVerified, opts...).ToFunc()
+}
+
+// ByClaimsPreferredUsername orders the results by the claims_preferred_username field.
+func ByClaimsPreferredUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsPreferredUsername, opts...).ToFunc()
+}
+
+// ByConnectorID orders the results by the connector_id field.
+func ByConnectorID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldConnectorID, opts...).ToFunc()
+}
+
+// ByExpiry orders the results by the expiry field.
+func ByExpiry(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldExpiry, opts...).ToFunc()
+}
+
+// ByCodeChallenge orders the results by the code_challenge field.
+func ByCodeChallenge(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCodeChallenge, opts...).ToFunc()
+}
+
+// ByCodeChallengeMethod orders the results by the code_challenge_method field.
+func ByCodeChallengeMethod(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCodeChallengeMethod, opts...).ToFunc()
+}
diff --git a/storage/ent/db/authcode_create.go b/storage/ent/db/authcode_create.go
index 323a470455..2441757b3e 100644
--- a/storage/ent/db/authcode_create.go
+++ b/storage/ent/db/authcode_create.go
@@ -148,7 +148,7 @@ func (acc *AuthCodeCreate) Mutation() *AuthCodeMutation {
 // Save creates the AuthCode in the database.
 func (acc *AuthCodeCreate) Save(ctx context.Context) (*AuthCode, error) {
 	acc.defaults()
-	return withHooks[*AuthCode, AuthCodeMutation](ctx, acc.sqlSave, acc.mutation, acc.hooks)
+	return withHooks(ctx, acc.sqlSave, acc.mutation, acc.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
@@ -389,8 +389,8 @@ func (accb *AuthCodeCreateBulk) Save(ctx context.Context) ([]*AuthCode, error) {
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
 					_, err = mutators[i+1].Mutate(root, accb.builders[i+1].mutation)
 				} else {
diff --git a/storage/ent/db/authcode_delete.go b/storage/ent/db/authcode_delete.go
index 18040794f2..1f758fccad 100644
--- a/storage/ent/db/authcode_delete.go
+++ b/storage/ent/db/authcode_delete.go
@@ -27,7 +27,7 @@ func (acd *AuthCodeDelete) Where(ps ...predicate.AuthCode) *AuthCodeDelete {
 
 // Exec executes the deletion query and returns how many vertices were deleted.
 func (acd *AuthCodeDelete) Exec(ctx context.Context) (int, error) {
-	return withHooks[int, AuthCodeMutation](ctx, acd.sqlExec, acd.mutation, acd.hooks)
+	return withHooks(ctx, acd.sqlExec, acd.mutation, acd.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
diff --git a/storage/ent/db/authcode_query.go b/storage/ent/db/authcode_query.go
index 49da12fa8f..75e5805b8f 100644
--- a/storage/ent/db/authcode_query.go
+++ b/storage/ent/db/authcode_query.go
@@ -18,7 +18,7 @@ import (
 type AuthCodeQuery struct {
 	config
 	ctx        *QueryContext
-	order      []OrderFunc
+	order      []authcode.OrderOption
 	inters     []Interceptor
 	predicates []predicate.AuthCode
 	// intermediate query (i.e. traversal path).
@@ -52,7 +52,7 @@ func (acq *AuthCodeQuery) Unique(unique bool) *AuthCodeQuery {
 }
 
 // Order specifies how the records should be ordered.
-func (acq *AuthCodeQuery) Order(o ...OrderFunc) *AuthCodeQuery {
+func (acq *AuthCodeQuery) Order(o ...authcode.OrderOption) *AuthCodeQuery {
 	acq.order = append(acq.order, o...)
 	return acq
 }
@@ -246,7 +246,7 @@ func (acq *AuthCodeQuery) Clone() *AuthCodeQuery {
 	return &AuthCodeQuery{
 		config:     acq.config,
 		ctx:        acq.ctx.Clone(),
-		order:      append([]OrderFunc{}, acq.order...),
+		order:      append([]authcode.OrderOption{}, acq.order...),
 		inters:     append([]Interceptor{}, acq.inters...),
 		predicates: append([]predicate.AuthCode{}, acq.predicates...),
 		// clone intermediate query.
diff --git a/storage/ent/db/authcode_update.go b/storage/ent/db/authcode_update.go
index 85d25672f1..0d6cd17697 100644
--- a/storage/ent/db/authcode_update.go
+++ b/storage/ent/db/authcode_update.go
@@ -180,7 +180,7 @@ func (acu *AuthCodeUpdate) Mutation() *AuthCodeMutation {
 
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (acu *AuthCodeUpdate) Save(ctx context.Context) (int, error) {
-	return withHooks[int, AuthCodeMutation](ctx, acu.sqlSave, acu.mutation, acu.hooks)
+	return withHooks(ctx, acu.sqlSave, acu.mutation, acu.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
@@ -505,7 +505,7 @@ func (acuo *AuthCodeUpdateOne) Select(field string, fields ...string) *AuthCodeU
 
 // Save executes the query and returns the updated AuthCode entity.
 func (acuo *AuthCodeUpdateOne) Save(ctx context.Context) (*AuthCode, error) {
-	return withHooks[*AuthCode, AuthCodeMutation](ctx, acuo.sqlSave, acuo.mutation, acuo.hooks)
+	return withHooks(ctx, acuo.sqlSave, acuo.mutation, acuo.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
diff --git a/storage/ent/db/authrequest.go b/storage/ent/db/authrequest.go
index 5cd6c4458c..b95592e58c 100644
--- a/storage/ent/db/authrequest.go
+++ b/storage/ent/db/authrequest.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
 )
@@ -56,7 +57,8 @@ type AuthRequest struct {
 	// CodeChallengeMethod holds the value of the "code_challenge_method" field.
 	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
 	// HmacKey holds the value of the "hmac_key" field.
-	HmacKey []byte `json:"hmac_key,omitempty"`
+	HmacKey      []byte `json:"hmac_key,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
@@ -73,7 +75,7 @@ func (*AuthRequest) scanValues(columns []string) ([]any, error) {
 		case authrequest.FieldExpiry:
 			values[i] = new(sql.NullTime)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type AuthRequest", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -219,11 +221,19 @@ func (ar *AuthRequest) assignValues(columns []string, values []any) error {
 			} else if value != nil {
 				ar.HmacKey = *value
 			}
+		default:
+			ar.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the AuthRequest.
+// This includes values selected through modifiers, order, etc.
+func (ar *AuthRequest) Value(name string) (ent.Value, error) {
+	return ar.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this AuthRequest.
 // Note that you need to call AuthRequest.Unwrap() before calling this method if this AuthRequest
 // was returned from a transaction, and the transaction was committed or rolled back.
diff --git a/storage/ent/db/authrequest/authrequest.go b/storage/ent/db/authrequest/authrequest.go
index 537f631efe..0998c79932 100644
--- a/storage/ent/db/authrequest/authrequest.go
+++ b/storage/ent/db/authrequest/authrequest.go
@@ -2,6 +2,10 @@
 
 package authrequest
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the authrequest type in the database.
 	Label = "auth_request"
@@ -96,3 +100,86 @@ var (
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the AuthRequest queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByClientID orders the results by the client_id field.
+func ByClientID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClientID, opts...).ToFunc()
+}
+
+// ByRedirectURI orders the results by the redirect_uri field.
+func ByRedirectURI(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldRedirectURI, opts...).ToFunc()
+}
+
+// ByNonce orders the results by the nonce field.
+func ByNonce(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldNonce, opts...).ToFunc()
+}
+
+// ByState orders the results by the state field.
+func ByState(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldState, opts...).ToFunc()
+}
+
+// ByForceApprovalPrompt orders the results by the force_approval_prompt field.
+func ByForceApprovalPrompt(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldForceApprovalPrompt, opts...).ToFunc()
+}
+
+// ByLoggedIn orders the results by the logged_in field.
+func ByLoggedIn(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldLoggedIn, opts...).ToFunc()
+}
+
+// ByClaimsUserID orders the results by the claims_user_id field.
+func ByClaimsUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUserID, opts...).ToFunc()
+}
+
+// ByClaimsUsername orders the results by the claims_username field.
+func ByClaimsUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUsername, opts...).ToFunc()
+}
+
+// ByClaimsEmail orders the results by the claims_email field.
+func ByClaimsEmail(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmail, opts...).ToFunc()
+}
+
+// ByClaimsEmailVerified orders the results by the claims_email_verified field.
+func ByClaimsEmailVerified(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmailVerified, opts...).ToFunc()
+}
+
+// ByClaimsPreferredUsername orders the results by the claims_preferred_username field.
+func ByClaimsPreferredUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsPreferredUsername, opts...).ToFunc()
+}
+
+// ByConnectorID orders the results by the connector_id field.
+func ByConnectorID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldConnectorID, opts...).ToFunc()
+}
+
+// ByExpiry orders the results by the expiry field.
+func ByExpiry(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldExpiry, opts...).ToFunc()
+}
+
+// ByCodeChallenge orders the results by the code_challenge field.
+func ByCodeChallenge(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCodeChallenge, opts...).ToFunc()
+}
+
+// ByCodeChallengeMethod orders the results by the code_challenge_method field.
+func ByCodeChallengeMethod(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCodeChallengeMethod, opts...).ToFunc()
+}
diff --git a/storage/ent/db/authrequest_create.go b/storage/ent/db/authrequest_create.go
index cf9c9e17fe..2c3d8f4191 100644
--- a/storage/ent/db/authrequest_create.go
+++ b/storage/ent/db/authrequest_create.go
@@ -178,7 +178,7 @@ func (arc *AuthRequestCreate) Mutation() *AuthRequestMutation {
 // Save creates the AuthRequest in the database.
 func (arc *AuthRequestCreate) Save(ctx context.Context) (*AuthRequest, error) {
 	arc.defaults()
-	return withHooks[*AuthRequest, AuthRequestMutation](ctx, arc.sqlSave, arc.mutation, arc.hooks)
+	return withHooks(ctx, arc.sqlSave, arc.mutation, arc.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
@@ -416,8 +416,8 @@ func (arcb *AuthRequestCreateBulk) Save(ctx context.Context) ([]*AuthRequest, er
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
 					_, err = mutators[i+1].Mutate(root, arcb.builders[i+1].mutation)
 				} else {
diff --git a/storage/ent/db/authrequest_delete.go b/storage/ent/db/authrequest_delete.go
index a1ddc5893e..0cef693afa 100644
--- a/storage/ent/db/authrequest_delete.go
+++ b/storage/ent/db/authrequest_delete.go
@@ -27,7 +27,7 @@ func (ard *AuthRequestDelete) Where(ps ...predicate.AuthRequest) *AuthRequestDel
 
 // Exec executes the deletion query and returns how many vertices were deleted.
 func (ard *AuthRequestDelete) Exec(ctx context.Context) (int, error) {
-	return withHooks[int, AuthRequestMutation](ctx, ard.sqlExec, ard.mutation, ard.hooks)
+	return withHooks(ctx, ard.sqlExec, ard.mutation, ard.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
diff --git a/storage/ent/db/authrequest_query.go b/storage/ent/db/authrequest_query.go
index 0bab5d4d1b..3ffbf7882b 100644
--- a/storage/ent/db/authrequest_query.go
+++ b/storage/ent/db/authrequest_query.go
@@ -18,7 +18,7 @@ import (
 type AuthRequestQuery struct {
 	config
 	ctx        *QueryContext
-	order      []OrderFunc
+	order      []authrequest.OrderOption
 	inters     []Interceptor
 	predicates []predicate.AuthRequest
 	// intermediate query (i.e. traversal path).
@@ -52,7 +52,7 @@ func (arq *AuthRequestQuery) Unique(unique bool) *AuthRequestQuery {
 }
 
 // Order specifies how the records should be ordered.
-func (arq *AuthRequestQuery) Order(o ...OrderFunc) *AuthRequestQuery {
+func (arq *AuthRequestQuery) Order(o ...authrequest.OrderOption) *AuthRequestQuery {
 	arq.order = append(arq.order, o...)
 	return arq
 }
@@ -246,7 +246,7 @@ func (arq *AuthRequestQuery) Clone() *AuthRequestQuery {
 	return &AuthRequestQuery{
 		config:     arq.config,
 		ctx:        arq.ctx.Clone(),
-		order:      append([]OrderFunc{}, arq.order...),
+		order:      append([]authrequest.OrderOption{}, arq.order...),
 		inters:     append([]Interceptor{}, arq.inters...),
 		predicates: append([]predicate.AuthRequest{}, arq.predicates...),
 		// clone intermediate query.
diff --git a/storage/ent/db/authrequest_update.go b/storage/ent/db/authrequest_update.go
index 1a72d7655c..2fb3c0cbec 100644
--- a/storage/ent/db/authrequest_update.go
+++ b/storage/ent/db/authrequest_update.go
@@ -222,7 +222,7 @@ func (aru *AuthRequestUpdate) Mutation() *AuthRequestMutation {
 
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (aru *AuthRequestUpdate) Save(ctx context.Context) (int, error) {
-	return withHooks[int, AuthRequestMutation](ctx, aru.sqlSave, aru.mutation, aru.hooks)
+	return withHooks(ctx, aru.sqlSave, aru.mutation, aru.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
@@ -569,7 +569,7 @@ func (aruo *AuthRequestUpdateOne) Select(field string, fields ...string) *AuthRe
 
 // Save executes the query and returns the updated AuthRequest entity.
 func (aruo *AuthRequestUpdateOne) Save(ctx context.Context) (*AuthRequest, error) {
-	return withHooks[*AuthRequest, AuthRequestMutation](ctx, aruo.sqlSave, aruo.mutation, aruo.hooks)
+	return withHooks(ctx, aruo.sqlSave, aruo.mutation, aruo.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
diff --git a/storage/ent/db/connector.go b/storage/ent/db/connector.go
index 2c954d1b67..34c88e31e6 100644
--- a/storage/ent/db/connector.go
+++ b/storage/ent/db/connector.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"strings"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/connector"
 )
@@ -22,7 +23,8 @@ type Connector struct {
 	// ResourceVersion holds the value of the "resource_version" field.
 	ResourceVersion string `json:"resource_version,omitempty"`
 	// Config holds the value of the "config" field.
-	Config []byte `json:"config,omitempty"`
+	Config       []byte `json:"config,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
@@ -35,7 +37,7 @@ func (*Connector) scanValues(columns []string) ([]any, error) {
 		case connector.FieldID, connector.FieldType, connector.FieldName, connector.FieldResourceVersion:
 			values[i] = new(sql.NullString)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type Connector", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -79,11 +81,19 @@ func (c *Connector) assignValues(columns []string, values []any) error {
 			} else if value != nil {
 				c.Config = *value
 			}
+		default:
+			c.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the Connector.
+// This includes values selected through modifiers, order, etc.
+func (c *Connector) Value(name string) (ent.Value, error) {
+	return c.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this Connector.
 // Note that you need to call Connector.Unwrap() before calling this method if this Connector
 // was returned from a transaction, and the transaction was committed or rolled back.
diff --git a/storage/ent/db/connector/connector.go b/storage/ent/db/connector/connector.go
index 8f52a8f710..996328c12e 100644
--- a/storage/ent/db/connector/connector.go
+++ b/storage/ent/db/connector/connector.go
@@ -2,6 +2,10 @@
 
 package connector
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the connector type in the database.
 	Label = "connector"
@@ -46,3 +50,26 @@ var (
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the Connector queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByType orders the results by the type field.
+func ByType(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldType, opts...).ToFunc()
+}
+
+// ByName orders the results by the name field.
+func ByName(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldName, opts...).ToFunc()
+}
+
+// ByResourceVersion orders the results by the resource_version field.
+func ByResourceVersion(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldResourceVersion, opts...).ToFunc()
+}
diff --git a/storage/ent/db/connector_create.go b/storage/ent/db/connector_create.go
index 9362684a8b..fda132147c 100644
--- a/storage/ent/db/connector_create.go
+++ b/storage/ent/db/connector_create.go
@@ -56,7 +56,7 @@ func (cc *ConnectorCreate) Mutation() *ConnectorMutation {
 
 // Save creates the Connector in the database.
 func (cc *ConnectorCreate) Save(ctx context.Context) (*Connector, error) {
-	return withHooks[*Connector, ConnectorMutation](ctx, cc.sqlSave, cc.mutation, cc.hooks)
+	return withHooks(ctx, cc.sqlSave, cc.mutation, cc.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
@@ -187,8 +187,8 @@ func (ccb *ConnectorCreateBulk) Save(ctx context.Context) ([]*Connector, error)
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
 					_, err = mutators[i+1].Mutate(root, ccb.builders[i+1].mutation)
 				} else {
diff --git a/storage/ent/db/connector_delete.go b/storage/ent/db/connector_delete.go
index f60df9b74b..f7f3ed1e0f 100644
--- a/storage/ent/db/connector_delete.go
+++ b/storage/ent/db/connector_delete.go
@@ -27,7 +27,7 @@ func (cd *ConnectorDelete) Where(ps ...predicate.Connector) *ConnectorDelete {
 
 // Exec executes the deletion query and returns how many vertices were deleted.
 func (cd *ConnectorDelete) Exec(ctx context.Context) (int, error) {
-	return withHooks[int, ConnectorMutation](ctx, cd.sqlExec, cd.mutation, cd.hooks)
+	return withHooks(ctx, cd.sqlExec, cd.mutation, cd.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
diff --git a/storage/ent/db/connector_query.go b/storage/ent/db/connector_query.go
index 89b10ec271..990af2aff2 100644
--- a/storage/ent/db/connector_query.go
+++ b/storage/ent/db/connector_query.go
@@ -18,7 +18,7 @@ import (
 type ConnectorQuery struct {
 	config
 	ctx        *QueryContext
-	order      []OrderFunc
+	order      []connector.OrderOption
 	inters     []Interceptor
 	predicates []predicate.Connector
 	// intermediate query (i.e. traversal path).
@@ -52,7 +52,7 @@ func (cq *ConnectorQuery) Unique(unique bool) *ConnectorQuery {
 }
 
 // Order specifies how the records should be ordered.
-func (cq *ConnectorQuery) Order(o ...OrderFunc) *ConnectorQuery {
+func (cq *ConnectorQuery) Order(o ...connector.OrderOption) *ConnectorQuery {
 	cq.order = append(cq.order, o...)
 	return cq
 }
@@ -246,7 +246,7 @@ func (cq *ConnectorQuery) Clone() *ConnectorQuery {
 	return &ConnectorQuery{
 		config:     cq.config,
 		ctx:        cq.ctx.Clone(),
-		order:      append([]OrderFunc{}, cq.order...),
+		order:      append([]connector.OrderOption{}, cq.order...),
 		inters:     append([]Interceptor{}, cq.inters...),
 		predicates: append([]predicate.Connector{}, cq.predicates...),
 		// clone intermediate query.
diff --git a/storage/ent/db/connector_update.go b/storage/ent/db/connector_update.go
index 1e6db2b1d3..035fe9c116 100644
--- a/storage/ent/db/connector_update.go
+++ b/storage/ent/db/connector_update.go
@@ -58,7 +58,7 @@ func (cu *ConnectorUpdate) Mutation() *ConnectorMutation {
 
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (cu *ConnectorUpdate) Save(ctx context.Context) (int, error) {
-	return withHooks[int, ConnectorMutation](ctx, cu.sqlSave, cu.mutation, cu.hooks)
+	return withHooks(ctx, cu.sqlSave, cu.mutation, cu.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
@@ -186,7 +186,7 @@ func (cuo *ConnectorUpdateOne) Select(field string, fields ...string) *Connector
 
 // Save executes the query and returns the updated Connector entity.
 func (cuo *ConnectorUpdateOne) Save(ctx context.Context) (*Connector, error) {
-	return withHooks[*Connector, ConnectorMutation](ctx, cuo.sqlSave, cuo.mutation, cuo.hooks)
+	return withHooks(ctx, cuo.sqlSave, cuo.mutation, cuo.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
diff --git a/storage/ent/db/devicerequest.go b/storage/ent/db/devicerequest.go
index ff82eb136e..df0194bb45 100644
--- a/storage/ent/db/devicerequest.go
+++ b/storage/ent/db/devicerequest.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
 )
@@ -28,7 +29,8 @@ type DeviceRequest struct {
 	// Scopes holds the value of the "scopes" field.
 	Scopes []string `json:"scopes,omitempty"`
 	// Expiry holds the value of the "expiry" field.
-	Expiry time.Time `json:"expiry,omitempty"`
+	Expiry       time.Time `json:"expiry,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
@@ -45,7 +47,7 @@ func (*DeviceRequest) scanValues(columns []string) ([]any, error) {
 		case devicerequest.FieldExpiry:
 			values[i] = new(sql.NullTime)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type DeviceRequest", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -103,11 +105,19 @@ func (dr *DeviceRequest) assignValues(columns []string, values []any) error {
 			} else if value.Valid {
 				dr.Expiry = value.Time
 			}
+		default:
+			dr.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the DeviceRequest.
+// This includes values selected through modifiers, order, etc.
+func (dr *DeviceRequest) Value(name string) (ent.Value, error) {
+	return dr.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this DeviceRequest.
 // Note that you need to call DeviceRequest.Unwrap() before calling this method if this DeviceRequest
 // was returned from a transaction, and the transaction was committed or rolled back.
diff --git a/storage/ent/db/devicerequest/devicerequest.go b/storage/ent/db/devicerequest/devicerequest.go
index 5dd032d613..d27f3971ca 100644
--- a/storage/ent/db/devicerequest/devicerequest.go
+++ b/storage/ent/db/devicerequest/devicerequest.go
@@ -2,6 +2,10 @@
 
 package devicerequest
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the devicerequest type in the database.
 	Label = "device_request"
@@ -54,3 +58,36 @@ var (
 	// ClientSecretValidator is a validator for the "client_secret" field. It is called by the builders before save.
 	ClientSecretValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the DeviceRequest queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByUserCode orders the results by the user_code field.
+func ByUserCode(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUserCode, opts...).ToFunc()
+}
+
+// ByDeviceCode orders the results by the device_code field.
+func ByDeviceCode(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldDeviceCode, opts...).ToFunc()
+}
+
+// ByClientID orders the results by the client_id field.
+func ByClientID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClientID, opts...).ToFunc()
+}
+
+// ByClientSecret orders the results by the client_secret field.
+func ByClientSecret(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClientSecret, opts...).ToFunc()
+}
+
+// ByExpiry orders the results by the expiry field.
+func ByExpiry(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldExpiry, opts...).ToFunc()
+}
diff --git a/storage/ent/db/devicerequest_create.go b/storage/ent/db/devicerequest_create.go
index 3aec60acdf..5b182d2493 100644
--- a/storage/ent/db/devicerequest_create.go
+++ b/storage/ent/db/devicerequest_create.go
@@ -63,7 +63,7 @@ func (drc *DeviceRequestCreate) Mutation() *DeviceRequestMutation {
 
 // Save creates the DeviceRequest in the database.
 func (drc *DeviceRequestCreate) Save(ctx context.Context) (*DeviceRequest, error) {
-	return withHooks[*DeviceRequest, DeviceRequestMutation](ctx, drc.sqlSave, drc.mutation, drc.hooks)
+	return withHooks(ctx, drc.sqlSave, drc.mutation, drc.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
@@ -201,8 +201,8 @@ func (drcb *DeviceRequestCreateBulk) Save(ctx context.Context) ([]*DeviceRequest
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
 					_, err = mutators[i+1].Mutate(root, drcb.builders[i+1].mutation)
 				} else {
diff --git a/storage/ent/db/devicerequest_delete.go b/storage/ent/db/devicerequest_delete.go
index ab3e494d28..b92f77984d 100644
--- a/storage/ent/db/devicerequest_delete.go
+++ b/storage/ent/db/devicerequest_delete.go
@@ -27,7 +27,7 @@ func (drd *DeviceRequestDelete) Where(ps ...predicate.DeviceRequest) *DeviceRequ
 
 // Exec executes the deletion query and returns how many vertices were deleted.
 func (drd *DeviceRequestDelete) Exec(ctx context.Context) (int, error) {
-	return withHooks[int, DeviceRequestMutation](ctx, drd.sqlExec, drd.mutation, drd.hooks)
+	return withHooks(ctx, drd.sqlExec, drd.mutation, drd.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
diff --git a/storage/ent/db/devicerequest_query.go b/storage/ent/db/devicerequest_query.go
index 4ee9fdd90b..de6092dc55 100644
--- a/storage/ent/db/devicerequest_query.go
+++ b/storage/ent/db/devicerequest_query.go
@@ -18,7 +18,7 @@ import (
 type DeviceRequestQuery struct {
 	config
 	ctx        *QueryContext
-	order      []OrderFunc
+	order      []devicerequest.OrderOption
 	inters     []Interceptor
 	predicates []predicate.DeviceRequest
 	// intermediate query (i.e. traversal path).
@@ -52,7 +52,7 @@ func (drq *DeviceRequestQuery) Unique(unique bool) *DeviceRequestQuery {
 }
 
 // Order specifies how the records should be ordered.
-func (drq *DeviceRequestQuery) Order(o ...OrderFunc) *DeviceRequestQuery {
+func (drq *DeviceRequestQuery) Order(o ...devicerequest.OrderOption) *DeviceRequestQuery {
 	drq.order = append(drq.order, o...)
 	return drq
 }
@@ -246,7 +246,7 @@ func (drq *DeviceRequestQuery) Clone() *DeviceRequestQuery {
 	return &DeviceRequestQuery{
 		config:     drq.config,
 		ctx:        drq.ctx.Clone(),
-		order:      append([]OrderFunc{}, drq.order...),
+		order:      append([]devicerequest.OrderOption{}, drq.order...),
 		inters:     append([]Interceptor{}, drq.inters...),
 		predicates: append([]predicate.DeviceRequest{}, drq.predicates...),
 		// clone intermediate query.
diff --git a/storage/ent/db/devicerequest_update.go b/storage/ent/db/devicerequest_update.go
index ccd42a85cc..1b48c36eb2 100644
--- a/storage/ent/db/devicerequest_update.go
+++ b/storage/ent/db/devicerequest_update.go
@@ -84,7 +84,7 @@ func (dru *DeviceRequestUpdate) Mutation() *DeviceRequestMutation {
 
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (dru *DeviceRequestUpdate) Save(ctx context.Context) (int, error) {
-	return withHooks[int, DeviceRequestMutation](ctx, dru.sqlSave, dru.mutation, dru.hooks)
+	return withHooks(ctx, dru.sqlSave, dru.mutation, dru.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
@@ -260,7 +260,7 @@ func (druo *DeviceRequestUpdateOne) Select(field string, fields ...string) *Devi
 
 // Save executes the query and returns the updated DeviceRequest entity.
 func (druo *DeviceRequestUpdateOne) Save(ctx context.Context) (*DeviceRequest, error) {
-	return withHooks[*DeviceRequest, DeviceRequestMutation](ctx, druo.sqlSave, druo.mutation, druo.hooks)
+	return withHooks(ctx, druo.sqlSave, druo.mutation, druo.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
diff --git a/storage/ent/db/devicetoken.go b/storage/ent/db/devicetoken.go
index 64261824c1..0eda024e05 100644
--- a/storage/ent/db/devicetoken.go
+++ b/storage/ent/db/devicetoken.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/devicetoken"
 )
@@ -32,6 +33,7 @@ type DeviceToken struct {
 	CodeChallenge string `json:"code_challenge,omitempty"`
 	// CodeChallengeMethod holds the value of the "code_challenge_method" field.
 	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
+	selectValues        sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
@@ -48,7 +50,7 @@ func (*DeviceToken) scanValues(columns []string) ([]any, error) {
 		case devicetoken.FieldExpiry, devicetoken.FieldLastRequest:
 			values[i] = new(sql.NullTime)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type DeviceToken", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -116,11 +118,19 @@ func (dt *DeviceToken) assignValues(columns []string, values []any) error {
 			} else if value.Valid {
 				dt.CodeChallengeMethod = value.String
 			}
+		default:
+			dt.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the DeviceToken.
+// This includes values selected through modifiers, order, etc.
+func (dt *DeviceToken) Value(name string) (ent.Value, error) {
+	return dt.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this DeviceToken.
 // Note that you need to call DeviceToken.Unwrap() before calling this method if this DeviceToken
 // was returned from a transaction, and the transaction was committed or rolled back.
diff --git a/storage/ent/db/devicetoken/devicetoken.go b/storage/ent/db/devicetoken/devicetoken.go
index f40b1b048a..7297244035 100644
--- a/storage/ent/db/devicetoken/devicetoken.go
+++ b/storage/ent/db/devicetoken/devicetoken.go
@@ -2,6 +2,10 @@
 
 package devicetoken
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the devicetoken type in the database.
 	Label = "device_token"
@@ -60,3 +64,46 @@ var (
 	// DefaultCodeChallengeMethod holds the default value on creation for the "code_challenge_method" field.
 	DefaultCodeChallengeMethod string
 )
+
+// OrderOption defines the ordering options for the DeviceToken queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByDeviceCode orders the results by the device_code field.
+func ByDeviceCode(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldDeviceCode, opts...).ToFunc()
+}
+
+// ByStatus orders the results by the status field.
+func ByStatus(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldStatus, opts...).ToFunc()
+}
+
+// ByExpiry orders the results by the expiry field.
+func ByExpiry(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldExpiry, opts...).ToFunc()
+}
+
+// ByLastRequest orders the results by the last_request field.
+func ByLastRequest(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldLastRequest, opts...).ToFunc()
+}
+
+// ByPollInterval orders the results by the poll_interval field.
+func ByPollInterval(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldPollInterval, opts...).ToFunc()
+}
+
+// ByCodeChallenge orders the results by the code_challenge field.
+func ByCodeChallenge(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCodeChallenge, opts...).ToFunc()
+}
+
+// ByCodeChallengeMethod orders the results by the code_challenge_method field.
+func ByCodeChallengeMethod(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCodeChallengeMethod, opts...).ToFunc()
+}
diff --git a/storage/ent/db/devicetoken_create.go b/storage/ent/db/devicetoken_create.go
index 5d6ba9ccbe..31e90fa222 100644
--- a/storage/ent/db/devicetoken_create.go
+++ b/storage/ent/db/devicetoken_create.go
@@ -92,7 +92,7 @@ func (dtc *DeviceTokenCreate) Mutation() *DeviceTokenMutation {
 // Save creates the DeviceToken in the database.
 func (dtc *DeviceTokenCreate) Save(ctx context.Context) (*DeviceToken, error) {
 	dtc.defaults()
-	return withHooks[*DeviceToken, DeviceTokenMutation](ctx, dtc.sqlSave, dtc.mutation, dtc.hooks)
+	return withHooks(ctx, dtc.sqlSave, dtc.mutation, dtc.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
@@ -247,8 +247,8 @@ func (dtcb *DeviceTokenCreateBulk) Save(ctx context.Context) ([]*DeviceToken, er
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
 					_, err = mutators[i+1].Mutate(root, dtcb.builders[i+1].mutation)
 				} else {
diff --git a/storage/ent/db/devicetoken_delete.go b/storage/ent/db/devicetoken_delete.go
index 8775ba63ed..9632450b0b 100644
--- a/storage/ent/db/devicetoken_delete.go
+++ b/storage/ent/db/devicetoken_delete.go
@@ -27,7 +27,7 @@ func (dtd *DeviceTokenDelete) Where(ps ...predicate.DeviceToken) *DeviceTokenDel
 
 // Exec executes the deletion query and returns how many vertices were deleted.
 func (dtd *DeviceTokenDelete) Exec(ctx context.Context) (int, error) {
-	return withHooks[int, DeviceTokenMutation](ctx, dtd.sqlExec, dtd.mutation, dtd.hooks)
+	return withHooks(ctx, dtd.sqlExec, dtd.mutation, dtd.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
diff --git a/storage/ent/db/devicetoken_query.go b/storage/ent/db/devicetoken_query.go
index f651bb2a0e..866e977c7c 100644
--- a/storage/ent/db/devicetoken_query.go
+++ b/storage/ent/db/devicetoken_query.go
@@ -18,7 +18,7 @@ import (
 type DeviceTokenQuery struct {
 	config
 	ctx        *QueryContext
-	order      []OrderFunc
+	order      []devicetoken.OrderOption
 	inters     []Interceptor
 	predicates []predicate.DeviceToken
 	// intermediate query (i.e. traversal path).
@@ -52,7 +52,7 @@ func (dtq *DeviceTokenQuery) Unique(unique bool) *DeviceTokenQuery {
 }
 
 // Order specifies how the records should be ordered.
-func (dtq *DeviceTokenQuery) Order(o ...OrderFunc) *DeviceTokenQuery {
+func (dtq *DeviceTokenQuery) Order(o ...devicetoken.OrderOption) *DeviceTokenQuery {
 	dtq.order = append(dtq.order, o...)
 	return dtq
 }
@@ -246,7 +246,7 @@ func (dtq *DeviceTokenQuery) Clone() *DeviceTokenQuery {
 	return &DeviceTokenQuery{
 		config:     dtq.config,
 		ctx:        dtq.ctx.Clone(),
-		order:      append([]OrderFunc{}, dtq.order...),
+		order:      append([]devicetoken.OrderOption{}, dtq.order...),
 		inters:     append([]Interceptor{}, dtq.inters...),
 		predicates: append([]predicate.DeviceToken{}, dtq.predicates...),
 		// clone intermediate query.
diff --git a/storage/ent/db/devicetoken_update.go b/storage/ent/db/devicetoken_update.go
index 1d37d53ad3..bed8cc47fc 100644
--- a/storage/ent/db/devicetoken_update.go
+++ b/storage/ent/db/devicetoken_update.go
@@ -112,7 +112,7 @@ func (dtu *DeviceTokenUpdate) Mutation() *DeviceTokenMutation {
 
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (dtu *DeviceTokenUpdate) Save(ctx context.Context) (int, error) {
-	return withHooks[int, DeviceTokenMutation](ctx, dtu.sqlSave, dtu.mutation, dtu.hooks)
+	return withHooks(ctx, dtu.sqlSave, dtu.mutation, dtu.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
@@ -311,7 +311,7 @@ func (dtuo *DeviceTokenUpdateOne) Select(field string, fields ...string) *Device
 
 // Save executes the query and returns the updated DeviceToken entity.
 func (dtuo *DeviceTokenUpdateOne) Save(ctx context.Context) (*DeviceToken, error) {
-	return withHooks[*DeviceToken, DeviceTokenMutation](ctx, dtuo.sqlSave, dtuo.mutation, dtuo.hooks)
+	return withHooks(ctx, dtuo.sqlSave, dtuo.mutation, dtuo.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
diff --git a/storage/ent/db/ent.go b/storage/ent/db/ent.go
index 292524ef1e..da7a801611 100644
--- a/storage/ent/db/ent.go
+++ b/storage/ent/db/ent.go
@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"reflect"
+	"sync"
 
 	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
@@ -69,42 +70,38 @@ func NewTxContext(parent context.Context, tx *Tx) context.Context {
 }
 
 // OrderFunc applies an ordering on the sql selector.
+// Deprecated: Use Asc/Desc functions or the package builders instead.
 type OrderFunc func(*sql.Selector)
 
-// columnChecker returns a function indicates if the column exists in the given column.
-func columnChecker(table string) func(string) error {
-	checks := map[string]func(string) bool{
-		authcode.Table:       authcode.ValidColumn,
-		authrequest.Table:    authrequest.ValidColumn,
-		connector.Table:      connector.ValidColumn,
-		devicerequest.Table:  devicerequest.ValidColumn,
-		devicetoken.Table:    devicetoken.ValidColumn,
-		keys.Table:           keys.ValidColumn,
-		oauth2client.Table:   oauth2client.ValidColumn,
-		offlinesession.Table: offlinesession.ValidColumn,
-		password.Table:       password.ValidColumn,
-		refreshtoken.Table:   refreshtoken.ValidColumn,
-	}
-	check, ok := checks[table]
-	if !ok {
-		return func(string) error {
-			return fmt.Errorf("unknown table %q", table)
-		}
-	}
-	return func(column string) error {
-		if !check(column) {
-			return fmt.Errorf("unknown column %q for table %q", column, table)
-		}
-		return nil
-	}
+var (
+	initCheck   sync.Once
+	columnCheck sql.ColumnCheck
+)
+
+// columnChecker checks if the column exists in the given table.
+func checkColumn(table, column string) error {
+	initCheck.Do(func() {
+		columnCheck = sql.NewColumnCheck(map[string]func(string) bool{
+			authcode.Table:       authcode.ValidColumn,
+			authrequest.Table:    authrequest.ValidColumn,
+			connector.Table:      connector.ValidColumn,
+			devicerequest.Table:  devicerequest.ValidColumn,
+			devicetoken.Table:    devicetoken.ValidColumn,
+			keys.Table:           keys.ValidColumn,
+			oauth2client.Table:   oauth2client.ValidColumn,
+			offlinesession.Table: offlinesession.ValidColumn,
+			password.Table:       password.ValidColumn,
+			refreshtoken.Table:   refreshtoken.ValidColumn,
+		})
+	})
+	return columnCheck(table, column)
 }
 
 // Asc applies the given fields in ASC order.
-func Asc(fields ...string) OrderFunc {
+func Asc(fields ...string) func(*sql.Selector) {
 	return func(s *sql.Selector) {
-		check := columnChecker(s.TableName())
 		for _, f := range fields {
-			if err := check(f); err != nil {
+			if err := checkColumn(s.TableName(), f); err != nil {
 				s.AddError(&ValidationError{Name: f, err: fmt.Errorf("db: %w", err)})
 			}
 			s.OrderBy(sql.Asc(s.C(f)))
@@ -113,11 +110,10 @@ func Asc(fields ...string) OrderFunc {
 }
 
 // Desc applies the given fields in DESC order.
-func Desc(fields ...string) OrderFunc {
+func Desc(fields ...string) func(*sql.Selector) {
 	return func(s *sql.Selector) {
-		check := columnChecker(s.TableName())
 		for _, f := range fields {
-			if err := check(f); err != nil {
+			if err := checkColumn(s.TableName(), f); err != nil {
 				s.AddError(&ValidationError{Name: f, err: fmt.Errorf("db: %w", err)})
 			}
 			s.OrderBy(sql.Desc(s.C(f)))
@@ -149,8 +145,7 @@ func Count() AggregateFunc {
 // Max applies the "max" aggregation function on the given field of each group.
 func Max(field string) AggregateFunc {
 	return func(s *sql.Selector) string {
-		check := columnChecker(s.TableName())
-		if err := check(field); err != nil {
+		if err := checkColumn(s.TableName(), field); err != nil {
 			s.AddError(&ValidationError{Name: field, err: fmt.Errorf("db: %w", err)})
 			return ""
 		}
@@ -161,8 +156,7 @@ func Max(field string) AggregateFunc {
 // Mean applies the "mean" aggregation function on the given field of each group.
 func Mean(field string) AggregateFunc {
 	return func(s *sql.Selector) string {
-		check := columnChecker(s.TableName())
-		if err := check(field); err != nil {
+		if err := checkColumn(s.TableName(), field); err != nil {
 			s.AddError(&ValidationError{Name: field, err: fmt.Errorf("db: %w", err)})
 			return ""
 		}
@@ -173,8 +167,7 @@ func Mean(field string) AggregateFunc {
 // Min applies the "min" aggregation function on the given field of each group.
 func Min(field string) AggregateFunc {
 	return func(s *sql.Selector) string {
-		check := columnChecker(s.TableName())
-		if err := check(field); err != nil {
+		if err := checkColumn(s.TableName(), field); err != nil {
 			s.AddError(&ValidationError{Name: field, err: fmt.Errorf("db: %w", err)})
 			return ""
 		}
@@ -185,8 +178,7 @@ func Min(field string) AggregateFunc {
 // Sum applies the "sum" aggregation function on the given field of each group.
 func Sum(field string) AggregateFunc {
 	return func(s *sql.Selector) string {
-		check := columnChecker(s.TableName())
-		if err := check(field); err != nil {
+		if err := checkColumn(s.TableName(), field); err != nil {
 			s.AddError(&ValidationError{Name: field, err: fmt.Errorf("db: %w", err)})
 			return ""
 		}
diff --git a/storage/ent/db/keys.go b/storage/ent/db/keys.go
index a297f28eba..ff84655e77 100644
--- a/storage/ent/db/keys.go
+++ b/storage/ent/db/keys.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/db/keys"
@@ -27,6 +28,7 @@ type Keys struct {
 	SigningKeyPub jose.JSONWebKey `json:"signing_key_pub,omitempty"`
 	// NextRotation holds the value of the "next_rotation" field.
 	NextRotation time.Time `json:"next_rotation,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
@@ -41,7 +43,7 @@ func (*Keys) scanValues(columns []string) ([]any, error) {
 		case keys.FieldNextRotation:
 			values[i] = new(sql.NullTime)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type Keys", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -91,11 +93,19 @@ func (k *Keys) assignValues(columns []string, values []any) error {
 			} else if value.Valid {
 				k.NextRotation = value.Time
 			}
+		default:
+			k.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the Keys.
+// This includes values selected through modifiers, order, etc.
+func (k *Keys) Value(name string) (ent.Value, error) {
+	return k.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this Keys.
 // Note that you need to call Keys.Unwrap() before calling this method if this Keys
 // was returned from a transaction, and the transaction was committed or rolled back.
diff --git a/storage/ent/db/keys/keys.go b/storage/ent/db/keys/keys.go
index eb96d92a11..a00f39b1fd 100644
--- a/storage/ent/db/keys/keys.go
+++ b/storage/ent/db/keys/keys.go
@@ -2,6 +2,10 @@
 
 package keys
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the keys type in the database.
 	Label = "keys"
@@ -42,3 +46,16 @@ var (
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the Keys queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByNextRotation orders the results by the next_rotation field.
+func ByNextRotation(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldNextRotation, opts...).ToFunc()
+}
diff --git a/storage/ent/db/keys_create.go b/storage/ent/db/keys_create.go
index 4740c5cb42..07943af939 100644
--- a/storage/ent/db/keys_create.go
+++ b/storage/ent/db/keys_create.go
@@ -59,7 +59,7 @@ func (kc *KeysCreate) Mutation() *KeysMutation {
 
 // Save creates the Keys in the database.
 func (kc *KeysCreate) Save(ctx context.Context) (*Keys, error) {
-	return withHooks[*Keys, KeysMutation](ctx, kc.sqlSave, kc.mutation, kc.hooks)
+	return withHooks(ctx, kc.sqlSave, kc.mutation, kc.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
@@ -180,8 +180,8 @@ func (kcb *KeysCreateBulk) Save(ctx context.Context) ([]*Keys, error) {
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
 					_, err = mutators[i+1].Mutate(root, kcb.builders[i+1].mutation)
 				} else {
diff --git a/storage/ent/db/keys_delete.go b/storage/ent/db/keys_delete.go
index b7a41f2859..7f66119452 100644
--- a/storage/ent/db/keys_delete.go
+++ b/storage/ent/db/keys_delete.go
@@ -27,7 +27,7 @@ func (kd *KeysDelete) Where(ps ...predicate.Keys) *KeysDelete {
 
 // Exec executes the deletion query and returns how many vertices were deleted.
 func (kd *KeysDelete) Exec(ctx context.Context) (int, error) {
-	return withHooks[int, KeysMutation](ctx, kd.sqlExec, kd.mutation, kd.hooks)
+	return withHooks(ctx, kd.sqlExec, kd.mutation, kd.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
diff --git a/storage/ent/db/keys_query.go b/storage/ent/db/keys_query.go
index 6b879652cf..3be00ff4df 100644
--- a/storage/ent/db/keys_query.go
+++ b/storage/ent/db/keys_query.go
@@ -18,7 +18,7 @@ import (
 type KeysQuery struct {
 	config
 	ctx        *QueryContext
-	order      []OrderFunc
+	order      []keys.OrderOption
 	inters     []Interceptor
 	predicates []predicate.Keys
 	// intermediate query (i.e. traversal path).
@@ -52,7 +52,7 @@ func (kq *KeysQuery) Unique(unique bool) *KeysQuery {
 }
 
 // Order specifies how the records should be ordered.
-func (kq *KeysQuery) Order(o ...OrderFunc) *KeysQuery {
+func (kq *KeysQuery) Order(o ...keys.OrderOption) *KeysQuery {
 	kq.order = append(kq.order, o...)
 	return kq
 }
@@ -246,7 +246,7 @@ func (kq *KeysQuery) Clone() *KeysQuery {
 	return &KeysQuery{
 		config:     kq.config,
 		ctx:        kq.ctx.Clone(),
-		order:      append([]OrderFunc{}, kq.order...),
+		order:      append([]keys.OrderOption{}, kq.order...),
 		inters:     append([]Interceptor{}, kq.inters...),
 		predicates: append([]predicate.Keys{}, kq.predicates...),
 		// clone intermediate query.
diff --git a/storage/ent/db/keys_update.go b/storage/ent/db/keys_update.go
index 1f8055c39e..7a059207ff 100644
--- a/storage/ent/db/keys_update.go
+++ b/storage/ent/db/keys_update.go
@@ -68,7 +68,7 @@ func (ku *KeysUpdate) Mutation() *KeysMutation {
 
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (ku *KeysUpdate) Save(ctx context.Context) (int, error) {
-	return withHooks[int, KeysMutation](ctx, ku.sqlSave, ku.mutation, ku.hooks)
+	return withHooks(ctx, ku.sqlSave, ku.mutation, ku.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
@@ -189,7 +189,7 @@ func (kuo *KeysUpdateOne) Select(field string, fields ...string) *KeysUpdateOne
 
 // Save executes the query and returns the updated Keys entity.
 func (kuo *KeysUpdateOne) Save(ctx context.Context) (*Keys, error) {
-	return withHooks[*Keys, KeysMutation](ctx, kuo.sqlSave, kuo.mutation, kuo.hooks)
+	return withHooks(ctx, kuo.sqlSave, kuo.mutation, kuo.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
diff --git a/storage/ent/db/oauth2client.go b/storage/ent/db/oauth2client.go
index 3c3fc65469..39a4cf82ab 100644
--- a/storage/ent/db/oauth2client.go
+++ b/storage/ent/db/oauth2client.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"strings"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/oauth2client"
 )
@@ -27,7 +28,8 @@ type OAuth2Client struct {
 	// Name holds the value of the "name" field.
 	Name string `json:"name,omitempty"`
 	// LogoURL holds the value of the "logo_url" field.
-	LogoURL string `json:"logo_url,omitempty"`
+	LogoURL      string `json:"logo_url,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
@@ -42,7 +44,7 @@ func (*OAuth2Client) scanValues(columns []string) ([]any, error) {
 		case oauth2client.FieldID, oauth2client.FieldSecret, oauth2client.FieldName, oauth2client.FieldLogoURL:
 			values[i] = new(sql.NullString)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type OAuth2Client", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -102,11 +104,19 @@ func (o *OAuth2Client) assignValues(columns []string, values []any) error {
 			} else if value.Valid {
 				o.LogoURL = value.String
 			}
+		default:
+			o.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the OAuth2Client.
+// This includes values selected through modifiers, order, etc.
+func (o *OAuth2Client) Value(name string) (ent.Value, error) {
+	return o.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this OAuth2Client.
 // Note that you need to call OAuth2Client.Unwrap() before calling this method if this OAuth2Client
 // was returned from a transaction, and the transaction was committed or rolled back.
diff --git a/storage/ent/db/oauth2client/oauth2client.go b/storage/ent/db/oauth2client/oauth2client.go
index 55b00c166b..08df76be9c 100644
--- a/storage/ent/db/oauth2client/oauth2client.go
+++ b/storage/ent/db/oauth2client/oauth2client.go
@@ -2,6 +2,10 @@
 
 package oauth2client
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the oauth2client type in the database.
 	Label = "oauth2client"
@@ -54,3 +58,31 @@ var (
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the OAuth2Client queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// BySecret orders the results by the secret field.
+func BySecret(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldSecret, opts...).ToFunc()
+}
+
+// ByPublic orders the results by the public field.
+func ByPublic(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldPublic, opts...).ToFunc()
+}
+
+// ByName orders the results by the name field.
+func ByName(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldName, opts...).ToFunc()
+}
+
+// ByLogoURL orders the results by the logo_url field.
+func ByLogoURL(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldLogoURL, opts...).ToFunc()
+}
diff --git a/storage/ent/db/oauth2client_create.go b/storage/ent/db/oauth2client_create.go
index 15eef174bf..f4a47d5557 100644
--- a/storage/ent/db/oauth2client_create.go
+++ b/storage/ent/db/oauth2client_create.go
@@ -68,7 +68,7 @@ func (oc *OAuth2ClientCreate) Mutation() *OAuth2ClientMutation {
 
 // Save creates the OAuth2Client in the database.
 func (oc *OAuth2ClientCreate) Save(ctx context.Context) (*OAuth2Client, error) {
-	return withHooks[*OAuth2Client, OAuth2ClientMutation](ctx, oc.sqlSave, oc.mutation, oc.hooks)
+	return withHooks(ctx, oc.sqlSave, oc.mutation, oc.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
@@ -212,8 +212,8 @@ func (ocb *OAuth2ClientCreateBulk) Save(ctx context.Context) ([]*OAuth2Client, e
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
 					_, err = mutators[i+1].Mutate(root, ocb.builders[i+1].mutation)
 				} else {
diff --git a/storage/ent/db/oauth2client_delete.go b/storage/ent/db/oauth2client_delete.go
index c53e032aeb..ee88e2800b 100644
--- a/storage/ent/db/oauth2client_delete.go
+++ b/storage/ent/db/oauth2client_delete.go
@@ -27,7 +27,7 @@ func (od *OAuth2ClientDelete) Where(ps ...predicate.OAuth2Client) *OAuth2ClientD
 
 // Exec executes the deletion query and returns how many vertices were deleted.
 func (od *OAuth2ClientDelete) Exec(ctx context.Context) (int, error) {
-	return withHooks[int, OAuth2ClientMutation](ctx, od.sqlExec, od.mutation, od.hooks)
+	return withHooks(ctx, od.sqlExec, od.mutation, od.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
diff --git a/storage/ent/db/oauth2client_query.go b/storage/ent/db/oauth2client_query.go
index 9b04b0880c..d2f49ec1d1 100644
--- a/storage/ent/db/oauth2client_query.go
+++ b/storage/ent/db/oauth2client_query.go
@@ -18,7 +18,7 @@ import (
 type OAuth2ClientQuery struct {
 	config
 	ctx        *QueryContext
-	order      []OrderFunc
+	order      []oauth2client.OrderOption
 	inters     []Interceptor
 	predicates []predicate.OAuth2Client
 	// intermediate query (i.e. traversal path).
@@ -52,7 +52,7 @@ func (oq *OAuth2ClientQuery) Unique(unique bool) *OAuth2ClientQuery {
 }
 
 // Order specifies how the records should be ordered.
-func (oq *OAuth2ClientQuery) Order(o ...OrderFunc) *OAuth2ClientQuery {
+func (oq *OAuth2ClientQuery) Order(o ...oauth2client.OrderOption) *OAuth2ClientQuery {
 	oq.order = append(oq.order, o...)
 	return oq
 }
@@ -246,7 +246,7 @@ func (oq *OAuth2ClientQuery) Clone() *OAuth2ClientQuery {
 	return &OAuth2ClientQuery{
 		config:     oq.config,
 		ctx:        oq.ctx.Clone(),
-		order:      append([]OrderFunc{}, oq.order...),
+		order:      append([]oauth2client.OrderOption{}, oq.order...),
 		inters:     append([]Interceptor{}, oq.inters...),
 		predicates: append([]predicate.OAuth2Client{}, oq.predicates...),
 		// clone intermediate query.
diff --git a/storage/ent/db/oauth2client_update.go b/storage/ent/db/oauth2client_update.go
index aa272911c3..b70feacc40 100644
--- a/storage/ent/db/oauth2client_update.go
+++ b/storage/ent/db/oauth2client_update.go
@@ -95,7 +95,7 @@ func (ou *OAuth2ClientUpdate) Mutation() *OAuth2ClientMutation {
 
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (ou *OAuth2ClientUpdate) Save(ctx context.Context) (int, error) {
-	return withHooks[int, OAuth2ClientMutation](ctx, ou.sqlSave, ou.mutation, ou.hooks)
+	return withHooks(ctx, ou.sqlSave, ou.mutation, ou.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
@@ -286,7 +286,7 @@ func (ouo *OAuth2ClientUpdateOne) Select(field string, fields ...string) *OAuth2
 
 // Save executes the query and returns the updated OAuth2Client entity.
 func (ouo *OAuth2ClientUpdateOne) Save(ctx context.Context) (*OAuth2Client, error) {
-	return withHooks[*OAuth2Client, OAuth2ClientMutation](ctx, ouo.sqlSave, ouo.mutation, ouo.hooks)
+	return withHooks(ctx, ouo.sqlSave, ouo.mutation, ouo.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
diff --git a/storage/ent/db/offlinesession.go b/storage/ent/db/offlinesession.go
index 639dcf5805..7adc3afca3 100644
--- a/storage/ent/db/offlinesession.go
+++ b/storage/ent/db/offlinesession.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"strings"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
 )
@@ -23,6 +24,7 @@ type OfflineSession struct {
 	Refresh []byte `json:"refresh,omitempty"`
 	// ConnectorData holds the value of the "connector_data" field.
 	ConnectorData *[]byte `json:"connector_data,omitempty"`
+	selectValues  sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
@@ -35,7 +37,7 @@ func (*OfflineSession) scanValues(columns []string) ([]any, error) {
 		case offlinesession.FieldID, offlinesession.FieldUserID, offlinesession.FieldConnID:
 			values[i] = new(sql.NullString)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type OfflineSession", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -79,11 +81,19 @@ func (os *OfflineSession) assignValues(columns []string, values []any) error {
 			} else if value != nil {
 				os.ConnectorData = value
 			}
+		default:
+			os.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the OfflineSession.
+// This includes values selected through modifiers, order, etc.
+func (os *OfflineSession) Value(name string) (ent.Value, error) {
+	return os.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this OfflineSession.
 // Note that you need to call OfflineSession.Unwrap() before calling this method if this OfflineSession
 // was returned from a transaction, and the transaction was committed or rolled back.
diff --git a/storage/ent/db/offlinesession/offlinesession.go b/storage/ent/db/offlinesession/offlinesession.go
index f996fe18d7..e7dbc446b7 100644
--- a/storage/ent/db/offlinesession/offlinesession.go
+++ b/storage/ent/db/offlinesession/offlinesession.go
@@ -2,6 +2,10 @@
 
 package offlinesession
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the offlinesession type in the database.
 	Label = "offline_session"
@@ -46,3 +50,21 @@ var (
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the OfflineSession queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByUserID orders the results by the user_id field.
+func ByUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUserID, opts...).ToFunc()
+}
+
+// ByConnID orders the results by the conn_id field.
+func ByConnID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldConnID, opts...).ToFunc()
+}
diff --git a/storage/ent/db/offlinesession_create.go b/storage/ent/db/offlinesession_create.go
index 98b4bc785b..28e2f502c0 100644
--- a/storage/ent/db/offlinesession_create.go
+++ b/storage/ent/db/offlinesession_create.go
@@ -56,7 +56,7 @@ func (osc *OfflineSessionCreate) Mutation() *OfflineSessionMutation {
 
 // Save creates the OfflineSession in the database.
 func (osc *OfflineSessionCreate) Save(ctx context.Context) (*OfflineSession, error) {
-	return withHooks[*OfflineSession, OfflineSessionMutation](ctx, osc.sqlSave, osc.mutation, osc.hooks)
+	return withHooks(ctx, osc.sqlSave, osc.mutation, osc.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
@@ -184,8 +184,8 @@ func (oscb *OfflineSessionCreateBulk) Save(ctx context.Context) ([]*OfflineSessi
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
 					_, err = mutators[i+1].Mutate(root, oscb.builders[i+1].mutation)
 				} else {
diff --git a/storage/ent/db/offlinesession_delete.go b/storage/ent/db/offlinesession_delete.go
index a5d794b2ea..354d0e9197 100644
--- a/storage/ent/db/offlinesession_delete.go
+++ b/storage/ent/db/offlinesession_delete.go
@@ -27,7 +27,7 @@ func (osd *OfflineSessionDelete) Where(ps ...predicate.OfflineSession) *OfflineS
 
 // Exec executes the deletion query and returns how many vertices were deleted.
 func (osd *OfflineSessionDelete) Exec(ctx context.Context) (int, error) {
-	return withHooks[int, OfflineSessionMutation](ctx, osd.sqlExec, osd.mutation, osd.hooks)
+	return withHooks(ctx, osd.sqlExec, osd.mutation, osd.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
diff --git a/storage/ent/db/offlinesession_query.go b/storage/ent/db/offlinesession_query.go
index 470146489d..93bbb916d6 100644
--- a/storage/ent/db/offlinesession_query.go
+++ b/storage/ent/db/offlinesession_query.go
@@ -18,7 +18,7 @@ import (
 type OfflineSessionQuery struct {
 	config
 	ctx        *QueryContext
-	order      []OrderFunc
+	order      []offlinesession.OrderOption
 	inters     []Interceptor
 	predicates []predicate.OfflineSession
 	// intermediate query (i.e. traversal path).
@@ -52,7 +52,7 @@ func (osq *OfflineSessionQuery) Unique(unique bool) *OfflineSessionQuery {
 }
 
 // Order specifies how the records should be ordered.
-func (osq *OfflineSessionQuery) Order(o ...OrderFunc) *OfflineSessionQuery {
+func (osq *OfflineSessionQuery) Order(o ...offlinesession.OrderOption) *OfflineSessionQuery {
 	osq.order = append(osq.order, o...)
 	return osq
 }
@@ -246,7 +246,7 @@ func (osq *OfflineSessionQuery) Clone() *OfflineSessionQuery {
 	return &OfflineSessionQuery{
 		config:     osq.config,
 		ctx:        osq.ctx.Clone(),
-		order:      append([]OrderFunc{}, osq.order...),
+		order:      append([]offlinesession.OrderOption{}, osq.order...),
 		inters:     append([]Interceptor{}, osq.inters...),
 		predicates: append([]predicate.OfflineSession{}, osq.predicates...),
 		// clone intermediate query.
diff --git a/storage/ent/db/offlinesession_update.go b/storage/ent/db/offlinesession_update.go
index ab81571713..9c5a37c013 100644
--- a/storage/ent/db/offlinesession_update.go
+++ b/storage/ent/db/offlinesession_update.go
@@ -64,7 +64,7 @@ func (osu *OfflineSessionUpdate) Mutation() *OfflineSessionMutation {
 
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (osu *OfflineSessionUpdate) Save(ctx context.Context) (int, error) {
-	return withHooks[int, OfflineSessionMutation](ctx, osu.sqlSave, osu.mutation, osu.hooks)
+	return withHooks(ctx, osu.sqlSave, osu.mutation, osu.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
@@ -201,7 +201,7 @@ func (osuo *OfflineSessionUpdateOne) Select(field string, fields ...string) *Off
 
 // Save executes the query and returns the updated OfflineSession entity.
 func (osuo *OfflineSessionUpdateOne) Save(ctx context.Context) (*OfflineSession, error) {
-	return withHooks[*OfflineSession, OfflineSessionMutation](ctx, osuo.sqlSave, osuo.mutation, osuo.hooks)
+	return withHooks(ctx, osuo.sqlSave, osuo.mutation, osuo.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
diff --git a/storage/ent/db/password.go b/storage/ent/db/password.go
index 5b9f5a1d7c..70f8ad2b1e 100644
--- a/storage/ent/db/password.go
+++ b/storage/ent/db/password.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"strings"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/password"
 )
@@ -22,7 +23,8 @@ type Password struct {
 	// Username holds the value of the "username" field.
 	Username string `json:"username,omitempty"`
 	// UserID holds the value of the "user_id" field.
-	UserID string `json:"user_id,omitempty"`
+	UserID       string `json:"user_id,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
@@ -37,7 +39,7 @@ func (*Password) scanValues(columns []string) ([]any, error) {
 		case password.FieldEmail, password.FieldUsername, password.FieldUserID:
 			values[i] = new(sql.NullString)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type Password", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -81,11 +83,19 @@ func (pa *Password) assignValues(columns []string, values []any) error {
 			} else if value.Valid {
 				pa.UserID = value.String
 			}
+		default:
+			pa.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the Password.
+// This includes values selected through modifiers, order, etc.
+func (pa *Password) Value(name string) (ent.Value, error) {
+	return pa.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this Password.
 // Note that you need to call Password.Unwrap() before calling this method if this Password
 // was returned from a transaction, and the transaction was committed or rolled back.
diff --git a/storage/ent/db/password/password.go b/storage/ent/db/password/password.go
index 34fcac69b8..37ab1e49a0 100644
--- a/storage/ent/db/password/password.go
+++ b/storage/ent/db/password/password.go
@@ -2,6 +2,10 @@
 
 package password
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the password type in the database.
 	Label = "password"
@@ -46,3 +50,26 @@ var (
 	// UserIDValidator is a validator for the "user_id" field. It is called by the builders before save.
 	UserIDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the Password queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByEmail orders the results by the email field.
+func ByEmail(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldEmail, opts...).ToFunc()
+}
+
+// ByUsername orders the results by the username field.
+func ByUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUsername, opts...).ToFunc()
+}
+
+// ByUserID orders the results by the user_id field.
+func ByUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUserID, opts...).ToFunc()
+}
diff --git a/storage/ent/db/password_create.go b/storage/ent/db/password_create.go
index ea9ea4b989..a6b83d2f9b 100644
--- a/storage/ent/db/password_create.go
+++ b/storage/ent/db/password_create.go
@@ -50,7 +50,7 @@ func (pc *PasswordCreate) Mutation() *PasswordMutation {
 
 // Save creates the Password in the database.
 func (pc *PasswordCreate) Save(ctx context.Context) (*Password, error) {
-	return withHooks[*Password, PasswordMutation](ctx, pc.sqlSave, pc.mutation, pc.hooks)
+	return withHooks(ctx, pc.sqlSave, pc.mutation, pc.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
@@ -172,8 +172,8 @@ func (pcb *PasswordCreateBulk) Save(ctx context.Context) ([]*Password, error) {
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
 					_, err = mutators[i+1].Mutate(root, pcb.builders[i+1].mutation)
 				} else {
diff --git a/storage/ent/db/password_delete.go b/storage/ent/db/password_delete.go
index 964430c650..784d545ee6 100644
--- a/storage/ent/db/password_delete.go
+++ b/storage/ent/db/password_delete.go
@@ -27,7 +27,7 @@ func (pd *PasswordDelete) Where(ps ...predicate.Password) *PasswordDelete {
 
 // Exec executes the deletion query and returns how many vertices were deleted.
 func (pd *PasswordDelete) Exec(ctx context.Context) (int, error) {
-	return withHooks[int, PasswordMutation](ctx, pd.sqlExec, pd.mutation, pd.hooks)
+	return withHooks(ctx, pd.sqlExec, pd.mutation, pd.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
diff --git a/storage/ent/db/password_query.go b/storage/ent/db/password_query.go
index 6a216658c7..6f5ff263ba 100644
--- a/storage/ent/db/password_query.go
+++ b/storage/ent/db/password_query.go
@@ -18,7 +18,7 @@ import (
 type PasswordQuery struct {
 	config
 	ctx        *QueryContext
-	order      []OrderFunc
+	order      []password.OrderOption
 	inters     []Interceptor
 	predicates []predicate.Password
 	// intermediate query (i.e. traversal path).
@@ -52,7 +52,7 @@ func (pq *PasswordQuery) Unique(unique bool) *PasswordQuery {
 }
 
 // Order specifies how the records should be ordered.
-func (pq *PasswordQuery) Order(o ...OrderFunc) *PasswordQuery {
+func (pq *PasswordQuery) Order(o ...password.OrderOption) *PasswordQuery {
 	pq.order = append(pq.order, o...)
 	return pq
 }
@@ -246,7 +246,7 @@ func (pq *PasswordQuery) Clone() *PasswordQuery {
 	return &PasswordQuery{
 		config:     pq.config,
 		ctx:        pq.ctx.Clone(),
-		order:      append([]OrderFunc{}, pq.order...),
+		order:      append([]password.OrderOption{}, pq.order...),
 		inters:     append([]Interceptor{}, pq.inters...),
 		predicates: append([]predicate.Password{}, pq.predicates...),
 		// clone intermediate query.
diff --git a/storage/ent/db/password_update.go b/storage/ent/db/password_update.go
index 03bf6ab4c6..f7855dc72d 100644
--- a/storage/ent/db/password_update.go
+++ b/storage/ent/db/password_update.go
@@ -58,7 +58,7 @@ func (pu *PasswordUpdate) Mutation() *PasswordMutation {
 
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (pu *PasswordUpdate) Save(ctx context.Context) (int, error) {
-	return withHooks[int, PasswordMutation](ctx, pu.sqlSave, pu.mutation, pu.hooks)
+	return withHooks(ctx, pu.sqlSave, pu.mutation, pu.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
@@ -191,7 +191,7 @@ func (puo *PasswordUpdateOne) Select(field string, fields ...string) *PasswordUp
 
 // Save executes the query and returns the updated Password entity.
 func (puo *PasswordUpdateOne) Save(ctx context.Context) (*Password, error) {
-	return withHooks[*Password, PasswordMutation](ctx, puo.sqlSave, puo.mutation, puo.hooks)
+	return withHooks(ctx, puo.sqlSave, puo.mutation, puo.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
diff --git a/storage/ent/db/refreshtoken.go b/storage/ent/db/refreshtoken.go
index 78fb79e7b5..f116d6846c 100644
--- a/storage/ent/db/refreshtoken.go
+++ b/storage/ent/db/refreshtoken.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
 )
@@ -46,7 +47,8 @@ type RefreshToken struct {
 	// CreatedAt holds the value of the "created_at" field.
 	CreatedAt time.Time `json:"created_at,omitempty"`
 	// LastUsed holds the value of the "last_used" field.
-	LastUsed time.Time `json:"last_used,omitempty"`
+	LastUsed     time.Time `json:"last_used,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
@@ -63,7 +65,7 @@ func (*RefreshToken) scanValues(columns []string) ([]any, error) {
 		case refreshtoken.FieldCreatedAt, refreshtoken.FieldLastUsed:
 			values[i] = new(sql.NullTime)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type RefreshToken", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -177,11 +179,19 @@ func (rt *RefreshToken) assignValues(columns []string, values []any) error {
 			} else if value.Valid {
 				rt.LastUsed = value.Time
 			}
+		default:
+			rt.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the RefreshToken.
+// This includes values selected through modifiers, order, etc.
+func (rt *RefreshToken) Value(name string) (ent.Value, error) {
+	return rt.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this RefreshToken.
 // Note that you need to call RefreshToken.Unwrap() before calling this method if this RefreshToken
 // was returned from a transaction, and the transaction was committed or rolled back.
diff --git a/storage/ent/db/refreshtoken/refreshtoken.go b/storage/ent/db/refreshtoken/refreshtoken.go
index d11d84075a..1163113d6b 100644
--- a/storage/ent/db/refreshtoken/refreshtoken.go
+++ b/storage/ent/db/refreshtoken/refreshtoken.go
@@ -4,6 +4,8 @@ package refreshtoken
 
 import (
 	"time"
+
+	"entgo.io/ent/dialect/sql"
 )
 
 const (
@@ -101,3 +103,71 @@ var (
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the RefreshToken queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByClientID orders the results by the client_id field.
+func ByClientID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClientID, opts...).ToFunc()
+}
+
+// ByNonce orders the results by the nonce field.
+func ByNonce(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldNonce, opts...).ToFunc()
+}
+
+// ByClaimsUserID orders the results by the claims_user_id field.
+func ByClaimsUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUserID, opts...).ToFunc()
+}
+
+// ByClaimsUsername orders the results by the claims_username field.
+func ByClaimsUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUsername, opts...).ToFunc()
+}
+
+// ByClaimsEmail orders the results by the claims_email field.
+func ByClaimsEmail(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmail, opts...).ToFunc()
+}
+
+// ByClaimsEmailVerified orders the results by the claims_email_verified field.
+func ByClaimsEmailVerified(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmailVerified, opts...).ToFunc()
+}
+
+// ByClaimsPreferredUsername orders the results by the claims_preferred_username field.
+func ByClaimsPreferredUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsPreferredUsername, opts...).ToFunc()
+}
+
+// ByConnectorID orders the results by the connector_id field.
+func ByConnectorID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldConnectorID, opts...).ToFunc()
+}
+
+// ByToken orders the results by the token field.
+func ByToken(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldToken, opts...).ToFunc()
+}
+
+// ByObsoleteToken orders the results by the obsolete_token field.
+func ByObsoleteToken(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldObsoleteToken, opts...).ToFunc()
+}
+
+// ByCreatedAt orders the results by the created_at field.
+func ByCreatedAt(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCreatedAt, opts...).ToFunc()
+}
+
+// ByLastUsed orders the results by the last_used field.
+func ByLastUsed(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldLastUsed, opts...).ToFunc()
+}
diff --git a/storage/ent/db/refreshtoken_create.go b/storage/ent/db/refreshtoken_create.go
index e44ab02c41..8ad5636190 100644
--- a/storage/ent/db/refreshtoken_create.go
+++ b/storage/ent/db/refreshtoken_create.go
@@ -164,7 +164,7 @@ func (rtc *RefreshTokenCreate) Mutation() *RefreshTokenMutation {
 // Save creates the RefreshToken in the database.
 func (rtc *RefreshTokenCreate) Save(ctx context.Context) (*RefreshToken, error) {
 	rtc.defaults()
-	return withHooks[*RefreshToken, RefreshTokenMutation](ctx, rtc.sqlSave, rtc.mutation, rtc.hooks)
+	return withHooks(ctx, rtc.sqlSave, rtc.mutation, rtc.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
@@ -408,8 +408,8 @@ func (rtcb *RefreshTokenCreateBulk) Save(ctx context.Context) ([]*RefreshToken,
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
 					_, err = mutators[i+1].Mutate(root, rtcb.builders[i+1].mutation)
 				} else {
diff --git a/storage/ent/db/refreshtoken_delete.go b/storage/ent/db/refreshtoken_delete.go
index 9e604101fe..78c8cbc6de 100644
--- a/storage/ent/db/refreshtoken_delete.go
+++ b/storage/ent/db/refreshtoken_delete.go
@@ -27,7 +27,7 @@ func (rtd *RefreshTokenDelete) Where(ps ...predicate.RefreshToken) *RefreshToken
 
 // Exec executes the deletion query and returns how many vertices were deleted.
 func (rtd *RefreshTokenDelete) Exec(ctx context.Context) (int, error) {
-	return withHooks[int, RefreshTokenMutation](ctx, rtd.sqlExec, rtd.mutation, rtd.hooks)
+	return withHooks(ctx, rtd.sqlExec, rtd.mutation, rtd.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
diff --git a/storage/ent/db/refreshtoken_query.go b/storage/ent/db/refreshtoken_query.go
index b7b3dd709f..ed6c3cc795 100644
--- a/storage/ent/db/refreshtoken_query.go
+++ b/storage/ent/db/refreshtoken_query.go
@@ -18,7 +18,7 @@ import (
 type RefreshTokenQuery struct {
 	config
 	ctx        *QueryContext
-	order      []OrderFunc
+	order      []refreshtoken.OrderOption
 	inters     []Interceptor
 	predicates []predicate.RefreshToken
 	// intermediate query (i.e. traversal path).
@@ -52,7 +52,7 @@ func (rtq *RefreshTokenQuery) Unique(unique bool) *RefreshTokenQuery {
 }
 
 // Order specifies how the records should be ordered.
-func (rtq *RefreshTokenQuery) Order(o ...OrderFunc) *RefreshTokenQuery {
+func (rtq *RefreshTokenQuery) Order(o ...refreshtoken.OrderOption) *RefreshTokenQuery {
 	rtq.order = append(rtq.order, o...)
 	return rtq
 }
@@ -246,7 +246,7 @@ func (rtq *RefreshTokenQuery) Clone() *RefreshTokenQuery {
 	return &RefreshTokenQuery{
 		config:     rtq.config,
 		ctx:        rtq.ctx.Clone(),
-		order:      append([]OrderFunc{}, rtq.order...),
+		order:      append([]refreshtoken.OrderOption{}, rtq.order...),
 		inters:     append([]Interceptor{}, rtq.inters...),
 		predicates: append([]predicate.RefreshToken{}, rtq.predicates...),
 		// clone intermediate query.
diff --git a/storage/ent/db/refreshtoken_update.go b/storage/ent/db/refreshtoken_update.go
index 2b6a23444b..6d9e022150 100644
--- a/storage/ent/db/refreshtoken_update.go
+++ b/storage/ent/db/refreshtoken_update.go
@@ -196,7 +196,7 @@ func (rtu *RefreshTokenUpdate) Mutation() *RefreshTokenMutation {
 
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (rtu *RefreshTokenUpdate) Save(ctx context.Context) (int, error) {
-	return withHooks[int, RefreshTokenMutation](ctx, rtu.sqlSave, rtu.mutation, rtu.hooks)
+	return withHooks(ctx, rtu.sqlSave, rtu.mutation, rtu.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
@@ -532,7 +532,7 @@ func (rtuo *RefreshTokenUpdateOne) Select(field string, fields ...string) *Refre
 
 // Save executes the query and returns the updated RefreshToken entity.
 func (rtuo *RefreshTokenUpdateOne) Save(ctx context.Context) (*RefreshToken, error) {
-	return withHooks[*RefreshToken, RefreshTokenMutation](ctx, rtuo.sqlSave, rtuo.mutation, rtuo.hooks)
+	return withHooks(ctx, rtuo.sqlSave, rtuo.mutation, rtuo.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
diff --git a/storage/ent/db/runtime/runtime.go b/storage/ent/db/runtime/runtime.go
index 4ebdb5eaa8..7d5bf1a421 100644
--- a/storage/ent/db/runtime/runtime.go
+++ b/storage/ent/db/runtime/runtime.go
@@ -5,6 +5,6 @@ package runtime
 // The schema-stitching logic is generated in github.com/dexidp/dex/storage/ent/db/runtime.go
 
 const (
-	Version = "v0.11.10"                                        // Version of ent codegen.
-	Sum     = "h1:iqn32ybY5HRW3xSAyMNdNKpZhKgMf1Zunsej9yPKUI8=" // Sum of ent codegen.
+	Version = "v0.12.3"                                         // Version of ent codegen.
+	Sum     = "h1:N5lO2EOrHpCH5HYfiMOCHYbo+oh5M8GjT0/cx5x6xkk=" // Sum of ent codegen.
 )