diff --git a/controllers/serviceinstance_controller.go b/controllers/serviceinstance_controller.go
index 94d913ab..afbe7ae2 100644
--- a/controllers/serviceinstance_controller.go
+++ b/controllers/serviceinstance_controller.go
@@ -638,17 +638,22 @@ func (r *ServiceInstanceReconciler) buildSMRequestParameters(ctx context.Context
 	} else {
 		if serviceInstance.Labels != nil {
 			// remove all secret labels
+			keysToDelete := []string{}
 			for key := range serviceInstance.Labels {
 				if strings.HasPrefix(key, common.InstanceSecretLabel) {
 					shouldUpdate = true
+					keysToDelete = append(keysToDelete, key)
 					err = utils.RemoveSecretWatch(ctx, r.Client, serviceInstance.Namespace, serviceInstance.Labels[key], serviceInstance.Name)
 					if err != nil {
 						log.Error(err, fmt.Sprintf("failed to decrease secret watch label with key %s", key))
 						return nil, err
 					}
-					delete(serviceInstance.Labels, key)
 				}
 			}
+			// Perform deletions after the iteration
+			for _, key := range keysToDelete {
+				delete(serviceInstance.Labels, key)
+			}
 		}
 	}
 	if shouldUpdate {