diff --git a/pkg/controller/keyvault/ingress_secret_provider_class_test.go b/pkg/controller/keyvault/ingress_secret_provider_class_test.go
index f7c55bf0..cfe1a17b 100644
--- a/pkg/controller/keyvault/ingress_secret_provider_class_test.go
+++ b/pkg/controller/keyvault/ingress_secret_provider_class_test.go
@@ -194,9 +194,6 @@ func TestIngressSecretProviderClassReconcilerIntegrationWithoutSPCLabels(t *test
 			}},
 		},
 	}
-	
-	require.NoError(t, util.Upsert(ctx, i.client, spc))
-	assert.Equal(t, 0, len(spc.Labels))
 
 	beforeErrCount = testutils.GetErrMetricCount(t, ingressSecretProviderControllerName)
 	beforeRequestCount = testutils.GetReconcileMetricCount(t, ingressSecretProviderControllerName, metrics.LabelSuccess)
@@ -207,6 +204,16 @@ func TestIngressSecretProviderClassReconcilerIntegrationWithoutSPCLabels(t *test
 
 	require.NoError(t, c.Get(ctx, client.ObjectKeyFromObject(spc), spc))
 
+	require.NoError(t, util.Upsert(ctx, i.client, spc))
+	assert.Equal(t, 0, len(spc.Labels))
+
+	beforeErrCount = testutils.GetErrMetricCount(t, ingressSecretProviderControllerName)
+	beforeRequestCount = testutils.GetReconcileMetricCount(t, ingressSecretProviderControllerName, metrics.LabelSuccess)
+	_, err = i.Reconcile(ctx, req)
+	require.NoError(t, err)
+	require.Equal(t, testutils.GetErrMetricCount(t, ingressSecretProviderControllerName), beforeErrCount)
+	require.Greater(t, testutils.GetReconcileMetricCount(t, ingressSecretProviderControllerName, metrics.LabelSuccess), beforeRequestCount)
+
 	expected := &secv1.SecretProviderClass{
 		Spec: secv1.SecretProviderClassSpec{
 			Provider: "azure",