diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go b/control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go
index 429fbbe9a1b1..9e1e0aba9fd3 100644
--- a/control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go
+++ b/control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go
@@ -1625,16 +1625,24 @@ func (r *reconciler) reconcileCloudCredentialSecrets(ctx context.Context, hcp *h
 			}
 			return nil
 		}
-		roleMap := map[string]*corev1.Secret{}
+		type cred struct {
+			secret *corev1.Secret
+			arn    string
+		}
 
-		roleMap[hcp.Spec.Platform.AWS.RolesRef.StorageARN] = manifests.AWSStorageCloudCredsSecret()
+		secretsToSync := []cred{
+			{secret: manifests.AWSStorageCloudCredsSecret(), arn: hcp.Spec.Platform.AWS.RolesRef.StorageARN},
+		}
 
 		if capabilities.IsIngressCapabilityEnabled(hcp.Spec.Capabilities) {
-			roleMap[hcp.Spec.Platform.AWS.RolesRef.IngressARN] = manifests.AWSIngressCloudCredsSecret()
+			secretsToSync = append(secretsToSync, cred{
+				secret: manifests.AWSIngressCloudCredsSecret(),
+				arn:    hcp.Spec.Platform.AWS.RolesRef.IngressARN,
+			})
 		}
 
-		for arn, secret := range roleMap {
-			if err := syncSecret(secret, arn); err != nil {
+		for _, cred := range secretsToSync {
+			if err := syncSecret(cred.secret, cred.arn); err != nil {
 				errs = append(errs, err)
 			}
 		}