diff --git a/pkg/controller/clusterissuers/checks.go b/pkg/controller/clusterissuers/checks.go
index 60044f042..092b036c3 100644
--- a/pkg/controller/clusterissuers/checks.go
+++ b/pkg/controller/clusterissuers/checks.go
@@ -60,11 +60,11 @@ func (c *controller) issuersForSecret(secret *corev1.Secret) ([]*v1.ClusterIssue
 					affected = append(affected, iss)
 					continue
 				}
-			}
-			if iss.Spec.Venafi.TPP.CABundleSecretRef != nil {
-				if iss.Spec.Venafi.TPP.CABundleSecretRef.Name == secret.Name {
-					affected = append(affected, iss)
-					continue
+				if iss.Spec.Venafi.TPP.CABundleSecretRef != nil {
+					if iss.Spec.Venafi.TPP.CABundleSecretRef.Name == secret.Name {
+						affected = append(affected, iss)
+						continue
+					}
 				}
 			}
 			if iss.Spec.Venafi.Cloud != nil {
diff --git a/pkg/controller/issuers/checks.go b/pkg/controller/issuers/checks.go
index 8e95dd64d..8f03e658c 100644
--- a/pkg/controller/issuers/checks.go
+++ b/pkg/controller/issuers/checks.go
@@ -62,11 +62,11 @@ func (c *controller) issuersForSecret(secret *corev1.Secret) ([]*v1.Issuer, erro
 					affected = append(affected, iss)
 					continue
 				}
-			}
-			if iss.Spec.Venafi.TPP.CABundleSecretRef != nil {
-				if iss.Spec.Venafi.TPP.CABundleSecretRef.Name == secret.Name {
-					affected = append(affected, iss)
-					continue
+				if iss.Spec.Venafi.TPP.CABundleSecretRef != nil {
+					if iss.Spec.Venafi.TPP.CABundleSecretRef.Name == secret.Name {
+						affected = append(affected, iss)
+						continue
+					}
 				}
 			}
 			if iss.Spec.Venafi.Cloud != nil {