diff --git a/api/models/component.go b/api/models/component.go
index 22cae155..88837164 100644
--- a/api/models/component.go
+++ b/api/models/component.go
@@ -86,7 +86,7 @@ func getComponentExternalDNS(component radixv1.RadixCommonDeployComponent, secre
 		var certData, keyData []byte
 		status := deploymentModels.TLSStatusConsistent
 
-		if secretValue, ok := slice.FindFirst(secretList, isSecretWithName(externalAlias.FQDN)); ok {
+		if secretValue, ok := slice.FindFirst(secretList, isSecretWithName(operatorutils.GetExternalDnsTlsSecretName(externalAlias))); ok {
 			certData = secretValue.Data[corev1.TLSCertKey]
 			keyData = secretValue.Data[corev1.TLSPrivateKeyKey]
 			if certValue, keyValue := strings.TrimSpace(string(certData)), strings.TrimSpace(string(keyData)); len(certValue) == 0 || len(keyValue) == 0 || strings.EqualFold(certValue, secretDefaultData) || strings.EqualFold(keyValue, secretDefaultData) {
diff --git a/api/secrets/secret_handler.go b/api/secrets/secret_handler.go
index e7b05b78..db7d4bfb 100644
--- a/api/secrets/secret_handler.go
+++ b/api/secrets/secret_handler.go
@@ -175,7 +175,7 @@ func (eh *SecretHandler) UpdateComponentExternalDNSSecretData(ctx context.Contex
 	}
 
 	ns := operatorutils.GetEnvironmentNamespace(appName, envName)
-	if err := eh.setSecretKeyValue(ctx, ns, fqdn, map[string][]byte{corev1.TLSCertKey: certificateBytes, corev1.TLSPrivateKeyKey: privateKeyBytes}); err != nil {
+	if err := eh.setSecretKeyValue(ctx, ns, operatorutils.GetExternalDnsTlsSecretName(externalDNS), map[string][]byte{corev1.TLSCertKey: certificateBytes, corev1.TLSPrivateKeyKey: privateKeyBytes}); err != nil {
 		return radixhttp.UnexpectedError(fmt.Sprintf("Failed to update TLS private key and certificate for %q", fqdn), err)
 	}