diff --git a/lib/kubernetes-deploy.rb b/lib/kubernetes-deploy.rb
index 055739d3d..fdd44ed23 100644
--- a/lib/kubernetes-deploy.rb
+++ b/lib/kubernetes-deploy.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'active_support/core_ext/object/blank'
+require 'active_support/core_ext/hash/reverse_merge'
 require 'active_support/core_ext/hash/slice'
 require 'active_support/core_ext/numeric/time'
 require 'active_support/core_ext/string/inflections'
diff --git a/lib/kubernetes-deploy/ejson_secret_provisioner.rb b/lib/kubernetes-deploy/ejson_secret_provisioner.rb
index 3cffa76d0..85aee91d1 100644
--- a/lib/kubernetes-deploy/ejson_secret_provisioner.rb
+++ b/lib/kubernetes-deploy/ejson_secret_provisioner.rb
@@ -106,7 +106,7 @@ def generate_secret_resource(secret_name, secret_type, data)
       end
 
       labels = { "name" => secret_name }
-      labels.reverse_merge!(@selector) if @selector
+      labels.reverse_merge!(@selector.to_h) if @selector
 
       secret = {
         'kind' => 'Secret',
diff --git a/test/unit/kubernetes-deploy/ejson_secret_provisioner_test.rb b/test/unit/kubernetes-deploy/ejson_secret_provisioner_test.rb
index d926ab9d0..5401d4738 100644
--- a/test/unit/kubernetes-deploy/ejson_secret_provisioner_test.rb
+++ b/test/unit/kubernetes-deploy/ejson_secret_provisioner_test.rb
@@ -101,6 +101,16 @@ def test_proactively_validates_resulting_resources_and_raises_without_logging
     refute_logs_match("Secret")
   end
 
+  def test_run_with_selector_does_not_raise_exception
+    stub_ejson_keys_get_request
+    stub_dry_run_validation_request.times(3) # there are three secrets in the ejson
+    provisioner = build_provisioner(
+      fixture_path('ejson-cloud'),
+      selector: KubernetesDeploy::LabelSelector.new("app" => "yay")
+    )
+    refute_empty(provisioner.resources)
+  end
+
   private
 
   def stub_ejson_keys_get_request
@@ -162,14 +172,15 @@ def dummy_secret_hash(name: SecureRandom.hex(4), data: {}, ejson: true)
     secret
   end
 
-  def build_provisioner(dir = nil)
+  def build_provisioner(dir = nil, selector: nil)
     dir ||= fixture_path('ejson-cloud')
     KubernetesDeploy::EjsonSecretProvisioner.new(
       namespace: 'test',
       context: KubeclientHelper::TEST_CONTEXT,
       template_dir: dir,
       logger: logger,
-      statsd_tags: []
+      statsd_tags: [],
+      selector: selector,
     )
   end
 end