diff --git a/persistence/sql/migrations/20230512112801000001_refresh_requested_at_index.down.sql b/persistence/sql/migrations/20230512112801000001_refresh_requested_at_index.down.sql
new file mode 100644
index 00000000000..cee58284abb
--- /dev/null
+++ b/persistence/sql/migrations/20230512112801000001_refresh_requested_at_index.down.sql
@@ -0,0 +1 @@
+DROP INDEX hydra_oauth2_refresh_requested_at_idx;
diff --git a/persistence/sql/migrations/20230512112801000001_refresh_requested_at_index.up.sql b/persistence/sql/migrations/20230512112801000001_refresh_requested_at_index.up.sql
new file mode 100644
index 00000000000..e0d1e273ed9
--- /dev/null
+++ b/persistence/sql/migrations/20230512112801000001_refresh_requested_at_index.up.sql
@@ -0,0 +1 @@
+CREATE INDEX hydra_oauth2_refresh_requested_at_idx ON hydra_oauth2_refresh (nid, requested_at);
diff --git a/persistence/sql/persister_oauth2.go b/persistence/sql/persister_oauth2.go
index 59d82957754..e2ae3887516 100644
--- a/persistence/sql/persister_oauth2.go
+++ b/persistence/sql/persister_oauth2.go
@@ -452,7 +452,7 @@ func (p *Persister) flushInactiveTokens(ctx context.Context, notAfter time.Time,
 		// The outer SELECT is necessary because our version of MySQL doesn't yet support 'LIMIT & IN/ALL/ANY/SOME subquery
 		deletedRecords, err = p.Connection(ctx).RawQuery(
 			fmt.Sprintf(`DELETE FROM %s WHERE signature in (
-				SELECT signature FROM (SELECT signature FROM %s hoa WHERE requested_at < ? and nid = ? ORDER BY signature LIMIT %d )  as s
+				SELECT signature FROM (SELECT signature FROM %s hoa WHERE requested_at < ? and nid = ? ORDER BY requested_at LIMIT %d ) as s
 			)`, OAuth2RequestSQL{Table: table}.TableName(), OAuth2RequestSQL{Table: table}.TableName(), d),
 			notAfter,
 			p.NetworkID(ctx),