diff --git a/build/make/deploy.mk b/build/make/deploy.mk
index 44f7c9a7f..f94e07eef 100644
--- a/build/make/deploy.mk
+++ b/build/make/deploy.mk
@@ -67,6 +67,13 @@ _store_tls_cert:
 	  $(K8S_CLI) get secret devworkspace-webhookserver-tls -n $(NAMESPACE) -o json | jq -r '.data["tls.key"]' | base64 -d > /tmp/k8s-webhook-server/serving-certs/tls.key
   endif
 
+_check_controller_running:
+	REPLICAS=$$($(K8S_CLI) get deploy devworkspace-controller-manager -n $(NAMESPACE) -o=json | jq -r '.spec.replicas')
+	if [ "$$REPLICAS" != "0" ]; then \
+	  echo "Controller is already running in cluster, cannot run locally. Scale controller to 0 first." ;\
+	  exit 1 ;\
+	fi
+
 ### install: Install controller in the configured Kubernetes cluster in ~/.kube/config
 install: _print_vars _check_cert_manager _init_devworkspace_crds _create_namespace generate_deployment
   ifeq ($(PLATFORM),kubernetes)
@@ -143,7 +150,7 @@ _bump_kubeconfig:
 	cp $(CONFIG_FILE) $(BUMPED_KUBECONFIG)
 
 ### run: Runs against the configured Kubernetes cluster in ~/.kube/config
-run: _print_vars _gen_configuration_env _bump_kubeconfig _login_with_devworkspace_sa _store_tls_cert
+run: _print_vars _gen_configuration_env _bump_kubeconfig _login_with_devworkspace_sa _store_tls_cert _check_controller_running
 	source $(CONTROLLER_ENV_FILE)
 	export KUBECONFIG=$(BUMPED_KUBECONFIG)
 	CONTROLLER_SERVICE_ACCOUNT_NAME=$(DEVWORKSPACE_CTRL_SA) \
@@ -151,7 +158,7 @@ run: _print_vars _gen_configuration_env _bump_kubeconfig _login_with_devworkspac
 	  go run ./main.go
 
 ### debug: Runs the controller locally with debugging enabled, watching cluster defined in ~/.kube/config
-debug: _print_vars _gen_configuration_env _bump_kubeconfig _login_with_devworkspace_sa _store_tls_cert
+debug: _print_vars _gen_configuration_env _bump_kubeconfig _login_with_devworkspace_sa _store_tls_cert _check_controller_running
 	source $(CONTROLLER_ENV_FILE)
 	export KUBECONFIG=$(BUMPED_KUBECONFIG)
 	CONTROLLER_SERVICE_ACCOUNT_NAME=$(DEVWORKSPACE_CTRL_SA) \