diff --git a/controllers/tenant/limitranges.go b/controllers/tenant/limitranges.go
index d17ea22a..661abcb2 100644
--- a/controllers/tenant/limitranges.go
+++ b/controllers/tenant/limitranges.go
@@ -55,7 +55,7 @@ func (r *Manager) syncLimitRange(ctx context.Context, tenant *capsulev1beta2.Ten
 		return err
 	}
 
-	for i, spec := range tenant.Spec.LimitRanges.Items {
+	for i, spec := range tenant.Spec.LimitRanges.Items { //nolint:dupl
 		target := &corev1.LimitRange{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      fmt.Sprintf("capsule-%s-%d", tenant.Name, i),
@@ -65,10 +65,14 @@ func (r *Manager) syncLimitRange(ctx context.Context, tenant *capsulev1beta2.Ten
 
 		var res controllerutil.OperationResult
 		res, err = controllerutil.CreateOrUpdate(ctx, r.Client, target, func() (err error) {
-			target.ObjectMeta.Labels = map[string]string{
-				tenantLabel:     tenant.Name,
-				limitRangeLabel: strconv.Itoa(i),
+			labels := target.GetLabels()
+			if labels == nil {
+				labels = map[string]string{}
 			}
+			labels[tenantLabel] = tenant.Name
+			labels[limitRangeLabel] = strconv.Itoa(i)
+
+			target.SetLabels(labels)
 			target.Spec = spec
 
 			return controllerutil.SetControllerReference(tenant, target, r.Client.Scheme())
diff --git a/controllers/tenant/networkpolicies.go b/controllers/tenant/networkpolicies.go
index b8bf53ba..40091391 100644
--- a/controllers/tenant/networkpolicies.go
+++ b/controllers/tenant/networkpolicies.go
@@ -54,7 +54,7 @@ func (r *Manager) syncNetworkPolicy(ctx context.Context, tenant *capsulev1beta2.
 		return err
 	}
 
-	for i, spec := range tenant.Spec.NetworkPolicies.Items {
+	for i, spec := range tenant.Spec.NetworkPolicies.Items { //nolint:dupl
 		target := &networkingv1.NetworkPolicy{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      fmt.Sprintf("capsule-%s-%d", tenant.Name, i),
@@ -64,10 +64,15 @@ func (r *Manager) syncNetworkPolicy(ctx context.Context, tenant *capsulev1beta2.
 
 		var res controllerutil.OperationResult
 		res, err = controllerutil.CreateOrUpdate(ctx, r.Client, target, func() (err error) {
-			target.SetLabels(map[string]string{
-				tenantLabel:        tenant.Name,
-				networkPolicyLabel: strconv.Itoa(i),
-			})
+			labels := target.GetLabels()
+			if labels == nil {
+				labels = map[string]string{}
+			}
+
+			labels[tenantLabel] = tenant.Name
+			labels[networkPolicyLabel] = strconv.Itoa(i)
+
+			target.SetLabels(labels)
 			target.Spec = spec
 
 			return controllerutil.SetControllerReference(tenant, target, r.Client.Scheme())
diff --git a/controllers/tenant/resourcequotas.go b/controllers/tenant/resourcequotas.go
index 7f1e50fc..4f556b6b 100644
--- a/controllers/tenant/resourcequotas.go
+++ b/controllers/tenant/resourcequotas.go
@@ -196,10 +196,15 @@ func (r *Manager) syncResourceQuota(ctx context.Context, tenant *capsulev1beta2.
 
 		err = retry.RetryOnConflict(retry.DefaultBackoff, func() (retryErr error) {
 			res, retryErr = controllerutil.CreateOrUpdate(ctx, r.Client, target, func() (err error) {
-				target.SetLabels(map[string]string{
-					tenantLabel: tenant.Name,
-					typeLabel:   strconv.Itoa(index),
-				})
+				targetLabels := target.GetLabels()
+				if targetLabels == nil {
+					targetLabels = map[string]string{}
+				}
+
+				targetLabels[tenantLabel] = tenant.Name
+				targetLabels[typeLabel] = strconv.Itoa(index)
+
+				target.SetLabels(targetLabels)
 				target.Spec.Scopes = resQuota.Scopes
 				target.Spec.ScopeSelector = resQuota.ScopeSelector
 				// In case of Namespace scope for the ResourceQuota we can easily apply the bare specification
diff --git a/controllers/tenant/rolebindings.go b/controllers/tenant/rolebindings.go
index 065aa5bd..056106ff 100644
--- a/controllers/tenant/rolebindings.go
+++ b/controllers/tenant/rolebindings.go
@@ -128,10 +128,12 @@ func (r *Manager) syncAdditionalRoleBinding(ctx context.Context, tenant *capsule
 
 		var res controllerutil.OperationResult
 		res, err = controllerutil.CreateOrUpdate(ctx, r.Client, target, func() error {
-			target.ObjectMeta.Labels = map[string]string{
-				tenantLabel:      tenant.Name,
-				roleBindingLabel: roleBindingHashLabel,
+			if target.ObjectMeta.Labels == nil {
+				target.ObjectMeta.Labels = map[string]string{}
 			}
+
+			target.ObjectMeta.Labels[tenantLabel] = tenant.Name
+			target.ObjectMeta.Labels[roleBindingLabel] = roleBindingHashLabel
 			target.RoleRef = rbacv1.RoleRef{
 				APIGroup: rbacv1.GroupName,
 				Kind:     "ClusterRole",