diff --git a/CHANGELOG.md b/CHANGELOG.md
index a7a4d9f4..8c8a0750 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,15 @@ All notable changes to this project will be documented in this file.
 
 - Made RSA key length configurable for certificates issued by cert-manager ([#528]).
 
+### Fixed
+
+- Helm chart: The secret migration job can be omitted via Helm values ([#536]).
+- Helm chart: The tag of the tools image used for the secret migration job can
+  be changed in the Helm values and defaults now to 1.0.0-stackable24.11.0
+  rather than being hard-coded to 1.0.0-stackable24.7.0 ([#536]).
+
 [#528]: https://github.com/stackabletech/secret-operator/pull/528
+[#536]: https://github.com/stackabletech/secret-operator/pull/536
 
 ## [24.11.0] - 2024-11-18
 
diff --git a/deploy/helm/secret-operator/templates/secret_migration_job.yaml b/deploy/helm/secret-operator/templates/secret_migration_job.yaml
index ac23f3d7..3a7bc819 100644
--- a/deploy/helm/secret-operator/templates/secret_migration_job.yaml
+++ b/deploy/helm/secret-operator/templates/secret_migration_job.yaml
@@ -1,4 +1,5 @@
 ---
+{{ if .Values.secretMigrationJob.enabled -}}
 # Migrates the TLS CA key pair from the hard-coded default namespace to the operator namespace
 # See https://github.com/stackabletech/secret-operator/issues/453
 apiVersion: batch/v1
@@ -30,7 +31,7 @@ spec:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
       - name: migrate-secret
-        image: "{{ .Values.secretMigrationJob.image.repository }}:1.0.0-stackable24.7.0"
+        image: "{{ .Values.secretMigrationJob.image.repository }}:{{ .Values.secretMigrationJob.image.tag }}"
         imagePullPolicy: {{ .Values.secretMigrationJob.image.pullPolicy }}
         resources:
             {{ .Values.secretMigrationJob.resources | toYaml | nindent 12 }}
@@ -53,3 +54,4 @@ spec:
             fi
           fi
       restartPolicy: Never
+{{- end }}
diff --git a/deploy/helm/secret-operator/templates/secret_migration_rbac.yaml b/deploy/helm/secret-operator/templates/secret_migration_rbac.yaml
index d4a462d1..561a2416 100644
--- a/deploy/helm/secret-operator/templates/secret_migration_rbac.yaml
+++ b/deploy/helm/secret-operator/templates/secret_migration_rbac.yaml
@@ -1,4 +1,5 @@
 ---
+{{ if .Values.secretMigrationJob.enabled -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -53,4 +54,5 @@ rules:
       - watch
       - create
       - patch
-      - update
\ No newline at end of file
+      - update
+{{- end }}
diff --git a/deploy/helm/secret-operator/values.yaml b/deploy/helm/secret-operator/values.yaml
index a2a7fe6f..1c12089e 100644
--- a/deploy/helm/secret-operator/values.yaml
+++ b/deploy/helm/secret-operator/values.yaml
@@ -6,8 +6,10 @@ image:
   pullSecrets: []
 
 secretMigrationJob:
+  enabled: true
   image:
     repository: docker.stackable.tech/stackable/tools
+    tag: 1.0.0-stackable24.11.0
     pullPolicy: IfNotPresent
   resources:
     requests: