diff --git a/pkg/cloud/services/networking/securitygroups.go b/pkg/cloud/services/networking/securitygroups.go
index 919392ff29..4733315821 100644
--- a/pkg/cloud/services/networking/securitygroups.go
+++ b/pkg/cloud/services/networking/securitygroups.go
@@ -132,7 +132,7 @@ func (s *Service) generateDesiredSecGroups(openStackCluster *infrav1.OpenStackCl
 
 	if openStackCluster.Spec.Bastion != nil && openStackCluster.Spec.Bastion.Enabled {
 		controlPlaneRules = append(controlPlaneRules, GetSGControlPlaneSSH(secBastionGroupID)...)
-		controlPlaneRules = append(controlPlaneRules, GetSGWorkerSSH(secBastionGroupID)...)
+		workerRules = append(workerRules, GetSGWorkerSSH(secBastionGroupID)...)
 
 		desiredSecGroups[bastionSuffix] = infrav1.SecurityGroup{
 			Name: secGroupNames[bastionSuffix],