diff --git a/appc/appconnector.go b/appc/appconnector.go
index 4c5c6bac6..a0c3ca65f 100644
--- a/appc/appconnector.go
+++ b/appc/appconnector.go
@@ -71,6 +71,7 @@ func (e *AppConnector) UpdateDomains(domains []string) {
 
 	var oldDomains map[string][]netip.Addr
 	oldDomains, e.domains = e.domains, make(map[string][]netip.Addr, len(domains))
+	e.wildcards = e.wildcards[:0]
 	for _, d := range domains {
 		d = strings.ToLower(d)
 		if len(d) == 0 {
diff --git a/appc/appconnector_test.go b/appc/appconnector_test.go
index fda7ae2b8..002f16f1c 100644
--- a/appc/appconnector_test.go
+++ b/appc/appconnector_test.go
@@ -74,13 +74,25 @@ func TestWildcardDomains(t *testing.T) {
 	a.UpdateDomains([]string{"*.example.com"})
 	a.ObserveDNSResponse(dnsResponse("foo.example.com.", "192.0.0.8"))
 	if got, want := rc.routes, []netip.Prefix{netip.MustParsePrefix("192.0.0.8/32")}; !slices.Equal(got, want) {
-		t.Errorf("got %v; want %v", got, want)
+		t.Errorf("routes: got %v; want %v", got, want)
+	}
+	if got, want := a.wildcards, []string{"example.com"}; !slices.Equal(got, want) {
+		t.Errorf("wildcards: got %v; want %v", got, want)
 	}
 
 	a.UpdateDomains([]string{"*.example.com", "example.com"})
 	if _, ok := a.domains["foo.example.com"]; !ok {
 		t.Errorf("expected foo.example.com to be preserved in domains due to wildcard")
 	}
+	if got, want := a.wildcards, []string{"example.com"}; !slices.Equal(got, want) {
+		t.Errorf("wildcards: got %v; want %v", got, want)
+	}
+
+	// There was an early regression where the wildcard domain was added repeatedly, this guards against that.
+	a.UpdateDomains([]string{"*.example.com", "example.com"})
+	if len(a.wildcards) != 1 {
+		t.Errorf("expected only one wildcard domain, got %v", a.wildcards)
+	}
 }
 
 // dnsResponse is a test helper that creates a DNS response buffer for the given domain and address