diff --git a/api/v1/aerospikecluster_validating_webhook.go b/api/v1/aerospikecluster_validating_webhook.go
index 94ce14291..7b12a700e 100644
--- a/api/v1/aerospikecluster_validating_webhook.go
+++ b/api/v1/aerospikecluster_validating_webhook.go
@@ -1265,7 +1265,7 @@ func validateSecurityConfigUpdate(
 		}
 
 		if currentSecurityConfig && !desiredSecurityConfig {
-			return fmt.Errorf("cannot disable security in running cluster")
+			return fmt.Errorf("cannot disable cluster security in running cluster")
 		}
 	}
 
diff --git a/controllers/reconciler.go b/controllers/reconciler.go
index d5da4102f..d5887d8cc 100644
--- a/controllers/reconciler.go
+++ b/controllers/reconciler.go
@@ -1063,7 +1063,7 @@ func (r *SingleClusterReconciler) handleEnableDynamicConfig() error {
 
 		for idx := range pods.Items {
 			pod := &pods.Items[idx]
-			if pod.Annotations == nil {
+			if _, ok := pod.Annotations["aerospikeConf"]; !ok {
 				if err := r.updateAerospikeConfInPod(pod.Name); err != nil {
 					return err
 				}