diff --git a/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_controller.go b/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_controller.go
index 946a5e528..a7c5464a9 100644
--- a/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_controller.go
+++ b/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_controller.go
@@ -3,6 +3,7 @@ package controllers
 import (
 	"context"
 	"fmt"
+	"math/rand"
 	"time"
 
 	"k8s.io/apimachinery/pkg/api/errors"
@@ -28,6 +29,7 @@ type InfisicalDynamicSecretReconciler struct {
 	Scheme *runtime.Scheme
 
 	BaseLogger logr.Logger
+	Random     *rand.Rand
 }
 
 var infisicalDynamicSecretsResourceVariablesMap map[string]util.ResourceVariables = make(map[string]util.ResourceVariables)
diff --git a/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_helper.go b/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_helper.go
index 0d9cf53ee..c923a0be0 100644
--- a/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_helper.go
+++ b/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_helper.go
@@ -384,8 +384,9 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
 		// Calculate from creation to expiration
 		originalLeaseDuration := leaseExpiresAt.Sub(infisicalDynamicSecret.Status.Lease.CreationTimestamp.Time)
 
-		// 30% of the original duration (if the TTL has 50% or less of its time left, renew)
-		renewalThreshold := originalLeaseDuration * 50 / 100
+		// Generate a random percentage between 20% and 30%
+		jitterPercentage := 20 + r.Random.Intn(11) // Random int from 0 to 10, then add 20
+		renewalThreshold := originalLeaseDuration * time.Duration(jitterPercentage) / 100
 		timeUntilExpiration := time.Until(leaseExpiresAt)
 
 		nextReconcile = timeUntilExpiration / 2
@@ -424,7 +425,7 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
 			return defaultNextReconcile, err // Short requeue after creation
 		}
 
-		if timeUntilExpiration < renewalThreshold {
+		if timeUntilExpiration < renewalThreshold || timeUntilExpiration < 30*time.Second {
 			logger.Info(fmt.Sprintf("Lease renewal needed [leaseId=%s] [timeUntilExpiration=%v] [threshold=%v]",
 				infisicalDynamicSecret.Status.Lease.ID,
 				timeUntilExpiration,
diff --git a/k8-operator/go.sum b/k8-operator/go.sum
index f6b61945a..9037bc4a0 100644
--- a/k8-operator/go.sum
+++ b/k8-operator/go.sum
@@ -217,10 +217,6 @@ github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
 github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/infisical/go-sdk v0.4.1 h1:ZeLyc2+2TeIaw9odjxR3ipQqYzVSMOnd8/RaqyUNvBg=
-github.com/infisical/go-sdk v0.4.1/go.mod h1:6fWzAwTPIoKU49mQ2Oxu+aFnJu9n7k2JcNrZjzhHM2M=
-github.com/infisical/go-sdk v0.4.3 h1:O5ZJ2eCBAZDE9PIAfBPq9Utb2CgQKrhmj9R0oFTRu4U=
-github.com/infisical/go-sdk v0.4.3/go.mod h1:6fWzAwTPIoKU49mQ2Oxu+aFnJu9n7k2JcNrZjzhHM2M=
 github.com/infisical/go-sdk v0.4.4 h1:Z4CBzxfhiY6ikjRimOEeyEEnb3QT/BKw3OzNFH7Pe+U=
 github.com/infisical/go-sdk v0.4.4/go.mod h1:6fWzAwTPIoKU49mQ2Oxu+aFnJu9n7k2JcNrZjzhHM2M=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
diff --git a/k8-operator/main.go b/k8-operator/main.go
index 4afbf6e56..4ae3d866e 100644
--- a/k8-operator/main.go
+++ b/k8-operator/main.go
@@ -3,9 +3,12 @@ package main
 import (
 	"flag"
 	"os"
+	"time"
 
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
+	"math/rand"
+
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
 	"k8s.io/apimachinery/pkg/runtime"
@@ -97,6 +100,7 @@ func main() {
 		Client:     mgr.GetClient(),
 		Scheme:     mgr.GetScheme(),
 		BaseLogger: ctrl.Log,
+		Random:     rand.New(rand.NewSource(time.Now().UnixNano())),
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "InfisicalDynamicSecret")
 		os.Exit(1)