diff --git a/internal/fullnode/node_key_builder.go b/internal/fullnode/node_key_builder.go
index e610be90..3ed330b8 100644
--- a/internal/fullnode/node_key_builder.go
+++ b/internal/fullnode/node_key_builder.go
@@ -21,7 +21,7 @@ const nodeKeyFile = "node_key.json"
 // Returns an error if a new node key cannot be serialized. (Should never happen.)
 func BuildNodeKeySecrets(existing []*corev1.Secret, crd *cosmosv1.CosmosFullNode) ([]diff.Resource[*corev1.Secret], error) {
 	secrets := make([]diff.Resource[*corev1.Secret], crd.Spec.Replicas)
-	for i := crd.Spec.Ordinal.Start; i < crd.Spec.Ordinal.Start+crd.Spec.Replicas; i++ {
+	for i := int32(0); i < crd.Spec.Replicas; i++ {
 		var s corev1.Secret
 		s.Name = nodeKeySecretName(crd, i)
 		s.Namespace = crd.Namespace
diff --git a/internal/fullnode/peer_collector.go b/internal/fullnode/peer_collector.go
index 37c27c3a..555ef803 100644
--- a/internal/fullnode/peer_collector.go
+++ b/internal/fullnode/peer_collector.go
@@ -110,7 +110,7 @@ func (c PeerCollector) Collect(ctx context.Context, crd *cosmosv1.CosmosFullNode
 	if crd.Spec.Service.ClusterDomain != nil {
 		clusterDomain = *crd.Spec.Service.ClusterDomain
 	}
-	for i := int32(0); i < crd.Spec.Replicas; i++ {
+	for i := crd.Spec.Ordinal.Start; i < crd.Spec.Ordinal.Start+crd.Spec.Replicas; i++ {
 		secretName := nodeKeySecretName(crd, i)
 		var secret corev1.Secret
 		// Hoping the caching layer kubebuilder prevents API errors or rate limits. Simplifies logic to use a Get here