diff --git a/internal/controller/reconcile-domains.go b/internal/controller/reconcile-domains.go
index b90d847..4ca5b11 100644
--- a/internal/controller/reconcile-domains.go
+++ b/internal/controller/reconcile-domains.go
@@ -17,6 +17,7 @@ import (
 	certv1alpha1 "github.com/gardener/cert-management/pkg/apis/cert/v1alpha1"
 	dnsv1alpha1 "github.com/gardener/external-dns-management/pkg/apis/dns/v1alpha1"
 	"github.com/sap/cap-operator/pkg/apis/sme.sap.com/v1alpha1"
+	"golang.org/x/exp/slices"
 	"google.golang.org/protobuf/types/known/durationpb"
 	networkingv1beta1 "istio.io/api/networking/v1beta1"
 	istionwv1beta1 "istio.io/client-go/pkg/apis/networking/v1beta1"
@@ -1259,7 +1260,10 @@ func (c *Controller) cleanUpOperatorDomains(ctx context.Context, relevantDomainI
 func getCertificateDNSNames(relevantDomainInfo *operatorDomainInfo) []string {
 	dnsNames := []string{}
 	for _, domain := range relevantDomainInfo.Domains {
-		dnsNames = append(dnsNames, "*."+domain)
+		// Don't add duplicate DNSNames when multiple apps provide same secondary domain!
+		if !slices.ContainsFunc(dnsNames, func(dnsName string) bool { return dnsName == "*."+domain }) {
+			dnsNames = append(dnsNames, "*."+domain)
+		}
 	}
 	return dnsNames
 }