diff --git a/pkg/controller/direct/securesourcemanager/instance_controller.go b/pkg/controller/direct/securesourcemanager/instance_controller.go
index 7d66a9940c..01775dd115 100644
--- a/pkg/controller/direct/securesourcemanager/instance_controller.go
+++ b/pkg/controller/direct/securesourcemanager/instance_controller.go
@@ -82,6 +82,14 @@ func (m *secureSourceManagerInstanceModel) AdapterForObject(ctx context.Context,
 		obj.Spec.KmsKeyRef = kmsKeyRef
 	}
 
+	if obj.Spec.PrivateConfig != nil {
+		caPoolRef, err := refs.ResolvePrivateCACAPoolRef(ctx, reader, u, obj.Spec.PrivateConfig.CaPoolRef)
+		if err != nil {
+			return nil, err
+		}
+		obj.Spec.PrivateConfig.CaPoolRef = caPoolRef
+	}
+
 	mapCtx := &direct.MapContext{}
 	desired := SecureSourceManagerInstanceSpec_ToProto(mapCtx, &obj.Spec)
 	if mapCtx.Err() != nil {