diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 22a12399d9..a479e7fe36 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -57,13 +57,13 @@ jobs:
           - agent: 2.9.51  # renovate: juju-agent-pin-minor
             libjuju: ==2.9.49.1  # renovate: latest libjuju 2
             allure_on_amd64: false
-          - agent: 3.4.6  # renovate: juju-agent-pin-minor
+          - agent: 3.6.1  # renovate: juju-agent-pin-minor
             allure_on_amd64: true
         architecture:
           - amd64
         include:
           - juju:
-              agent: 3.4.6  # renovate: juju-agent-pin-minor
+              agent: 3.6.1  # renovate: juju-agent-pin-minor
               allure_on_amd64: true
             architecture: arm64
     name: Integration | ${{ matrix.juju.agent }} | ${{ matrix.architecture }}
diff --git a/lib/charms/postgresql_k8s/v0/postgresql.py b/lib/charms/postgresql_k8s/v0/postgresql.py
index 17adae9e61..986ae71f0d 100644
--- a/lib/charms/postgresql_k8s/v0/postgresql.py
+++ b/lib/charms/postgresql_k8s/v0/postgresql.py
@@ -21,7 +21,7 @@
 
 import logging
 from collections import OrderedDict
-from typing import Optional, Set, Tuple
+from typing import List, Optional, Set, Tuple
 
 import psycopg2
 from ops.model import Relation
@@ -35,7 +35,7 @@
 
 # Increment this PATCH version before using `charmcraft publish-lib` or reset
 # to 0 if you are raising the major API version
-LIBPATCH = 40
+LIBPATCH = 41
 
 INVALID_EXTRA_USER_ROLE_BLOCKING_MESSAGE = "invalid role(s) for extra user roles"
 
@@ -108,7 +108,7 @@ def __init__(
         user: str,
         password: str,
         database: str,
-        system_users: Optional[list[str]] = None,
+        system_users: Optional[List[str]] = None,
     ):
         self.primary_host = primary_host
         self.current_host = current_host
@@ -161,8 +161,8 @@ def create_database(
         self,
         database: str,
         user: str,
-        plugins: Optional[list[str]] = None,
-        client_relations: Optional[list[Relation]] = None,
+        plugins: Optional[List[str]] = None,
+        client_relations: Optional[List[Relation]] = None,
     ) -> None:
         """Creates a new database and grant privileges to a user on it.
 
@@ -368,8 +368,8 @@ def enable_disable_extensions(
                 connection.close()
 
     def _generate_database_privileges_statements(
-        self, relations_accessing_this_database: int, schemas: list[str], user: str
-    ) -> list[Composed]:
+        self, relations_accessing_this_database: int, schemas: List[str], user: str
+    ) -> List[Composed]:
         """Generates a list of databases privileges statements."""
         statements = []
         if relations_accessing_this_database == 1:
diff --git a/lib/charms/postgresql_k8s/v0/postgresql_tls.py b/lib/charms/postgresql_k8s/v0/postgresql_tls.py
index bdc7159a9d..5b2a0e937c 100644
--- a/lib/charms/postgresql_k8s/v0/postgresql_tls.py
+++ b/lib/charms/postgresql_k8s/v0/postgresql_tls.py
@@ -45,7 +45,7 @@
 
 # Increment this PATCH version before using `charmcraft publish-lib` or reset
 # to 0 if you are raising the major API version.
-LIBPATCH = 11
+LIBPATCH = 12
 
 logger = logging.getLogger(__name__)
 SCOPE = "unit"
@@ -130,11 +130,21 @@ def _on_certificate_available(self, event: CertificateAvailableEvent) -> None:
             logger.error("An unknown certificate available.")
             return
 
-        self.charm.set_secret(
-            SCOPE, "chain", "\n".join(event.chain) if event.chain is not None else None
-        )
-        self.charm.set_secret(SCOPE, "cert", event.certificate)
-        self.charm.set_secret(SCOPE, "ca", event.ca)
+        if not event.certificate:
+            logger.debug("No certificate available.")
+            event.defer()
+            return
+
+        chain = self.charm.get_secret(SCOPE, "chain")
+        new_chain = "\n".join(event.chain) if event.chain is not None else None
+        if chain != new_chain:
+            self.charm.set_secret(SCOPE, "chain", new_chain)
+        cert = self.charm.get_secret(SCOPE, "cert")
+        if cert != event.certificate:
+            self.charm.set_secret(SCOPE, "cert", event.certificate)
+        ca = self.charm.get_secret(SCOPE, "ca")
+        if ca != event.ca:
+            self.charm.set_secret(SCOPE, "ca", event.ca)
 
         try:
             if not self.charm.push_tls_files_to_workload():