diff --git a/internal/controller/provisioner/provisioner.go b/internal/controller/provisioner/provisioner.go
index d2957404f4..e489e693be 100644
--- a/internal/controller/provisioner/provisioner.go
+++ b/internal/controller/provisioner/provisioner.go
@@ -2,6 +2,7 @@ package provisioner
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"slices"
 	"strings"
@@ -246,33 +247,35 @@ func (p *NginxProvisioner) provisionNginx(
 		createCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
 
 		var res controllerutil.OperationResult
+		var upsertErr error
 		if err := wait.PollUntilContextCancel(
 			createCtx,
 			500*time.Millisecond,
 			true, /* poll immediately */
 			func(ctx context.Context) (bool, error) {
-				var upsertErr error
 				res, upsertErr = controllerutil.CreateOrUpdate(ctx, p.k8sClient, obj, objectSpecSetter(obj))
 				if upsertErr != nil {
-					if !apierrors.IsAlreadyExists(upsertErr) && !apierrors.IsConflict(upsertErr) {
-						return false, upsertErr
-					}
-					if apierrors.IsConflict(upsertErr) {
-						return false, nil
-					}
+					p.cfg.Logger.V(1).Info(
+						"Retrying CreateOrUpdate for nginx resource after error",
+						"namespace", gateway.GetNamespace(),
+						"name", resourceName,
+						"error", upsertErr.Error(),
+					)
+					return false, nil //nolint:nilerr // continue retrying
 				}
 				return true, nil
 			},
 		); err != nil {
+			fullErr := errors.Join(err, upsertErr)
 			p.cfg.EventRecorder.Eventf(
 				obj,
 				corev1.EventTypeWarning,
 				"CreateOrUpdateFailed",
 				"Failed to create or update nginx resource: %s",
-				err.Error(),
+				fullErr.Error(),
 			)
 			cancel()
-			return err
+			return fullErr
 		}
 		cancel()
 
@@ -327,6 +330,10 @@ func (p *NginxProvisioner) provisionNginx(
 			object = daemonSetObj
 		}
 
+		if object == nil {
+			return nil
+		}
+
 		p.cfg.Logger.V(1).Info(
 			"Restarting nginx after agent configmap update",
 			"name", object.GetName(),
diff --git a/internal/controller/provisioner/setter.go b/internal/controller/provisioner/setter.go
index b7204ade4a..d529e01af9 100644
--- a/internal/controller/provisioner/setter.go
+++ b/internal/controller/provisioner/setter.go
@@ -119,9 +119,7 @@ func serviceSpecSetter(
 		}
 
 		// Apply NGF-managed annotations (take precedence)
-		for k, v := range objectMeta.Annotations {
-			mergedAnnotations[k] = v
-		}
+		maps.Copy(mergedAnnotations, objectMeta.Annotations)
 
 		// Store current managed keys for next reconciliation
 		if len(currentManagedKeys) > 0 {