diff --git a/internal/controller/clientpool/clientpool.go b/internal/controller/clientpool/clientpool.go
index 8bfdf93f..0eac55c0 100644
--- a/internal/controller/clientpool/clientpool.go
+++ b/internal/controller/clientpool/clientpool.go
@@ -127,11 +127,11 @@ func (cp *ClientPool) UpsertClient(ctx context.Context, opts NewClientOptions) (
 		pemCert = secret.Data["tls.crt"]
 
 		// Check if certificate is expired before creating the client
-		expiryTime, err := calculateCertificateExpirationTime(pemCert, 5*time.Minute)
+		exp, err := calculateCertificateExpirationTime(pemCert, 5*time.Minute)
 		if err != nil {
 			return nil, fmt.Errorf("failed to check certificate expiration: %v", err)
 		}
-		expired, err := isCertificateExpired(expiryTime)
+		expired, err := isCertificateExpired(exp)
 		if err != nil {
 			return nil, fmt.Errorf("failed to check certificate expiration: %v", err)
 		}
@@ -146,6 +146,7 @@ func (cp *ClientPool) UpsertClient(ctx context.Context, opts NewClientOptions) (
 		clientOpts.ConnectionOptions.TLS = &tls.Config{
 			Certificates: []tls.Certificate{cert},
 		}
+		expiryTime = exp
 	}
 
 	c, err := sdkclient.Dial(clientOpts)