diff --git a/tljh/installer.py b/tljh/installer.py
index ba44bfb..b44782b 100644
--- a/tljh/installer.py
+++ b/tljh/installer.py
@@ -188,13 +188,13 @@ def ensure_jupyterhub_package(prefix):
     and conda packages!
     """
     conda.ensure_pip_packages(prefix, [
-        'jupyterhub==0.9.6',
+        'jupyterhub==1.0.0',
         'jupyterhub-dummyauthenticator==0.3.1',
         'jupyterhub-systemdspawner==0.13',
         'jupyterhub-firstuseauthenticator==0.12',
         'jupyterhub-nativeauthenticator==0.0.4',
         'jupyterhub-ldapauthenticator==1.2.2',
-        'oauthenticator==0.8.1'
+        'oauthenticator==0.8.2',
     ])
     traefik.ensure_traefik_binary(prefix)
 
@@ -241,7 +241,7 @@ def ensure_user_environment(user_requirements_txt_file):
 
     conda.ensure_pip_packages(USER_ENV_PREFIX, [
         # JupyterHub + notebook package are base requirements for user environment
-        'jupyterhub==0.9.6',
+        'jupyterhub==1.0.0',
         'notebook==5.7.8',
         # Install additional notebook frontends!
         'jupyterlab==0.35.4',
@@ -253,7 +253,7 @@ def ensure_user_environment(user_requirements_txt_file):
         # Most people consider ipywidgets to be part of the core notebook experience
         'ipywidgets==7.4.2',
         # Pin tornado
-        'tornado<6.0'
+        'tornado<6.0',
     ])
 
     if user_requirements_txt_file:
diff --git a/tljh/systemd-units/jupyterhub.service b/tljh/systemd-units/jupyterhub.service
index e766e20..477d04b 100644
--- a/tljh/systemd-units/jupyterhub.service
+++ b/tljh/systemd-units/jupyterhub.service
@@ -17,7 +17,9 @@ PrivateDevices=yes
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 Environment=TLJH_INSTALL_PREFIX={install_prefix}
-ExecStart={python_interpreter_path} -m jupyterhub.app -f {jupyterhub_config_path}
+# Run upgrade-db before starting, in case Hub version has changed
+# This is a no-op when no db exists or no upgrades are needed
+ExecStart={python_interpreter_path} -m jupyterhub.app -f {jupyterhub_config_path} --upgrade-db
 
 [Install]
 # Start service when system boots