diff --git a/controllers/toolchainclusterresources/toolchaincluster_resources_controller.go b/controllers/toolchainclusterresources/toolchaincluster_resources_controller.go
index 875240e5..1d690c0a 100644
--- a/controllers/toolchainclusterresources/toolchaincluster_resources_controller.go
+++ b/controllers/toolchainclusterresources/toolchaincluster_resources_controller.go
@@ -41,6 +41,7 @@ func (r *Reconciler) SetupWithManager(mgr ctrl.Manager, operatorNamespace string
 	if err != nil {
 		return err
 	}
+
 	mapToOwnerByLabel := handler.EnqueueRequestsFromMapFunc(commoncontroller.MapToControllerByMatchingLabel(toolchainv1alpha1.ProviderLabelKey, ResourceControllerLabelValue))
 	for _, obj := range r.templateObjects {
 		build = build.Watches(obj.DeepCopyObject().(runtimeclient.Object), mapToOwnerByLabel, builder.WithPredicates(commonpredicates.LabelsAndGenerationPredicate{}))
@@ -53,6 +54,7 @@ type Reconciler struct {
 	Client          runtimeclient.Client
 	Scheme          *runtime.Scheme
 	Templates       *embed.FS
+	FieldManager    string
 	templateObjects []*unstructured.Unstructured
 }
 
@@ -72,5 +74,6 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 
 	// TODO implement delete logic for objects that were renamed/removed from the templates
 
-	return reconcile.Result{}, applycl.ApplyUnstructuredObjectsWithNewLabels(ctx, r.Client, r.templateObjects, newLabels) // apply objects on the cluster
+	cl := applycl.NewSSAApplyClient(r.Client, r.FieldManager)
+	return reconcile.Result{}, applycl.ApplyAll(ctx, cl, r.templateObjects, applycl.EnsureLabels(newLabels)) // apply objects on the cluster
 }
diff --git a/controllers/toolchainclusterresources/toolchaincluster_resources_controller_test.go b/controllers/toolchainclusterresources/toolchaincluster_resources_controller_test.go
index 10329584..e1c78e47 100644
--- a/controllers/toolchainclusterresources/toolchaincluster_resources_controller_test.go
+++ b/controllers/toolchainclusterresources/toolchaincluster_resources_controller_test.go
@@ -110,6 +110,7 @@ func prepareReconcile(sa *v1.ServiceAccount, cl *test.FakeClient, templates *emb
 		Client:          cl,
 		Scheme:          scheme.Scheme,
 		Templates:       templates,
+		FieldManager:    "testOwner",
 		templateObjects: templateObjects,
 	}
 	req := reconcile.Request{
diff --git a/pkg/client/ssa_client.go b/pkg/client/ssa_client.go
index 0bd6eab5..622257cc 100644
--- a/pkg/client/ssa_client.go
+++ b/pkg/client/ssa_client.go
@@ -238,8 +238,13 @@ func EnsureGVK(obj client.Object, scheme *runtime.Scheme) error {
 
 // Apply is a utility function that just calls `ApplyObject` in a loop on all the supplied objects.
 func (c *SSAApplyClient) Apply(ctx context.Context, toolchainObjects []client.Object, opts ...SSAApplyObjectOption) error {
+	return ApplyAll(ctx, c, toolchainObjects, opts...)
+}
+
+// ApplyAll is a generic version of c.Apply that can accept a slice of anything that implements client.Object.
+func ApplyAll[T client.Object](ctx context.Context, cl *SSAApplyClient, toolchainObjects []T, opts ...SSAApplyObjectOption) error {
 	for _, toolchainObject := range toolchainObjects {
-		if err := c.ApplyObject(ctx, toolchainObject, opts...); err != nil {
+		if err := cl.ApplyObject(ctx, toolchainObject, opts...); err != nil {
 			return err
 		}
 	}