diff --git a/control-plane/connect-inject/endpoints_controller.go b/control-plane/connect-inject/endpoints_controller.go
index f4dbfdc893..aa55663b8a 100644
--- a/control-plane/connect-inject/endpoints_controller.go
+++ b/control-plane/connect-inject/endpoints_controller.go
@@ -178,6 +178,7 @@ func (r *EndpointsController) Reconcile(ctx context.Context, req ctrl.Request) (
 				serviceName, ok := pod.Annotations[annotationKubernetesService]
 				if ok && serviceEndpoints.Name != serviceName {
 					r.Log.Info("ignoring endpoint because it doesn't match explicit service annotation", "name", serviceEndpoints.Name, "ns", serviceEndpoints.Namespace)
+					// deregistration happens later because we don't add this pod to the endpointAddressMap
 					continue
 				}
 
diff --git a/control-plane/connect-inject/endpoints_controller_test.go b/control-plane/connect-inject/endpoints_controller_test.go
index 4f941f49f5..da198afa31 100644
--- a/control-plane/connect-inject/endpoints_controller_test.go
+++ b/control-plane/connect-inject/endpoints_controller_test.go
@@ -3455,15 +3455,34 @@ func TestReconcile_podSpecifiesExplicitService(t *testing.T) {
 		ConsulClientCfg:       cfg,
 	}
 
-	// Run the reconcile process to check service registration.
 	serviceName := badEndpoint.Name
+
+	// Initially register the pod with the bad endpoint
+	err = consulClient.Agent().ServiceRegister(&api.AgentServiceRegistration{
+		ID:      "pod1-" + serviceName,
+		Name:    serviceName,
+		Port:    0,
+		Address: "1.2.3.4",
+		Meta: map[string]string{
+			"k8s-namespace":    namespace,
+			"k8s-service-name": serviceName,
+			"managed-by":       "consul-k8s-endpoints-controller",
+			"pod-name":         "pod1",
+		},
+	})
+	require.NoError(t, err)
+	serviceInstances, _, err := consulClient.Catalog().Service(serviceName, "", nil)
+	require.NoError(t, err)
+	require.Len(t, serviceInstances, 1)
+
+	// Run the reconcile process to check service deregistration.
 	namespacedName := types.NamespacedName{Namespace: badEndpoint.Namespace, Name: serviceName}
 	resp, err := ep.Reconcile(context.Background(), ctrl.Request{NamespacedName: namespacedName})
 	require.NoError(t, err)
 	require.False(t, resp.Requeue)
 
-	// Check that no services are registered with Consul.
-	serviceInstances, _, err := consulClient.Catalog().Service(serviceName, "", nil)
+	// Check that the service has been deregistered with Consul.
+	serviceInstances, _, err = consulClient.Catalog().Service(serviceName, "", nil)
 	require.NoError(t, err)
 	require.Len(t, serviceInstances, 0)
 	proxyServiceInstances, _, err := consulClient.Catalog().Service(serviceName+"-sidecar-proxy", "", nil)