diff --git a/pkg/controller/ingress-controller.go b/pkg/controller/ingress-controller.go
index 3b82107..610ac2e 100644
--- a/pkg/controller/ingress-controller.go
+++ b/pkg/controller/ingress-controller.go
@@ -3,6 +3,8 @@ package controller
 import (
 	"context"
 	"fmt"
+	"slices"
+
 	cloudflarecontroller "github.com/STRRL/cloudflare-tunnel-ingress-controller/pkg/cloudflare-controller"
 	"github.com/STRRL/cloudflare-tunnel-ingress-controller/pkg/exposure"
 	"github.com/go-logr/logr"
@@ -99,16 +101,21 @@ func (i *IngressController) Reconcile(ctx context.Context, request reconcile.Req
 		}
 	}
 
-	origin.Status.LoadBalancer.Ingress = append(origin.Status.LoadBalancer.Ingress,
-		networkingv1.IngressLoadBalancerIngress{
-			Hostname: i.tunnelClient.TunnelDomain(),
+	hostname := i.tunnelClient.TunnelDomain()
+	newOrigin := origin.DeepCopy()
+	matchesHostname := func(ingress networkingv1.IngressLoadBalancerIngress) bool {
+		return ingress.Hostname == hostname
+	}
+	if !slices.ContainsFunc(origin.Status.LoadBalancer.Ingress, matchesHostname) {
+		newOrigin.Status.LoadBalancer.Ingress = []networkingv1.IngressLoadBalancerIngress{{
+			Hostname: hostname,
 			Ports: []networkingv1.IngressPortStatus{{
 				Protocol: v1.ProtocolTCP,
 				Port:     443,
 			}},
-		},
-	)
-	if err = i.kubeClient.Status().Update(ctx, &origin); err != nil {
+		}}
+	}
+	if err = i.kubeClient.Status().Update(ctx, newOrigin); err != nil {
 		return reconcile.Result{}, errors.Wrapf(err, "failed to update ingress status")
 	}