diff --git a/pkg/operator/build_hierarchy.go b/pkg/operator/build_hierarchy.go
index cab0b212644b..663a4ac6551c 100644
--- a/pkg/operator/build_hierarchy.go
+++ b/pkg/operator/build_hierarchy.go
@@ -236,7 +236,7 @@ func buildSecrets(ctx context.Context, cli client.Client, deploy config.Deployme
 			case *corev1.Secret:
 				rawValue, ok := o.Data[ref.Reference.Secret.Key]
 				if !ok {
-					return fmt.Errorf("no key %s in Secret %s", ref.Reference.ConfigMap.Key, o.Name)
+					return fmt.Errorf("no key %s in Secret %s", ref.Reference.Secret.Key, o.Name)
 				}
 				value = string(rawValue)
 			case *corev1.ConfigMap:
diff --git a/pkg/operator/build_hierarchy_test.go b/pkg/operator/build_hierarchy_test.go
index b77adb761c95..9bc13fca69c1 100644
--- a/pkg/operator/build_hierarchy_test.go
+++ b/pkg/operator/build_hierarchy_test.go
@@ -19,8 +19,10 @@ import (
 	"github.com/stretchr/testify/require"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/labels"
+	controller "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
 )
 
 // Test_buildHierarchy checks that an entire resource hierarchy can be
@@ -34,7 +36,7 @@ func Test_buildHierarchy(t *testing.T) {
 
 	l := util.TestLogger(t)
 	cluster := NewTestCluster(ctx, t, l)
-	cli := cluster.Client()
+	cli := newTestControllerClient(t, cluster)
 
 	resources := k8s.NewResourceSet(l, cluster)
 	defer resources.Stop()
@@ -164,3 +166,26 @@ func (w *resourceWalker) Visit(v interface{}) (next structwalk.Visitor) {
 	}
 	return w
 }
+
+// newTestControllerClient creates a Kubernetes client which uses a cache and
+// index for retrieving objects. This more closely matches the behavior of the
+// operator instead of using cluster.Client, which lacks a cache and always
+// communicates directly with Kubernetes.
+func newTestControllerClient(t *testing.T, cluster *k8s.Cluster) client.Client {
+	t.Helper()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	mgr, err := controller.NewManager(cluster.GetConfig(), manager.Options{
+		Scheme: cluster.Client().Scheme(),
+	})
+	require.NoError(t, err)
+
+	go func() {
+		require.NoError(t, mgr.Start(ctx))
+	}()
+	require.True(t, mgr.GetCache().WaitForCacheSync(ctx))
+
+	return mgr.GetClient()
+}
diff --git a/pkg/operator/hierarchy/selector.go b/pkg/operator/hierarchy/selector.go
index 06454e3a8f1e..d2a1493a2ccb 100644
--- a/pkg/operator/hierarchy/selector.go
+++ b/pkg/operator/hierarchy/selector.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/labels"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -79,7 +78,6 @@ var _ Selector = (*KeySelector)(nil)
 // ApplyToList implements Selector.
 func (ks *KeySelector) ApplyToList(lo *client.ListOptions) {
 	lo.Namespace = ks.Namespace
-	lo.FieldSelector = fields.OneTermEqualSelector("metadata.name", ks.Name)
 }
 
 // Matches implements Selector.