diff --git a/internal/controller/impersonatorconfig/impersonator_config.go b/internal/controller/impersonatorconfig/impersonator_config.go
index 6af922888..2e6a106a5 100644
--- a/internal/controller/impersonatorconfig/impersonator_config.go
+++ b/internal/controller/impersonatorconfig/impersonator_config.go
@@ -93,7 +93,6 @@ func NewImpersonatorConfigController(
 	servicesInformer corev1informers.ServiceInformer,
 	secretsInformer corev1informers.SecretInformer,
 	withInformer pinnipedcontroller.WithInformerOptionFunc,
-	withInitialEvent pinnipedcontroller.WithInitialEventOptionFunc,
 	generatedLoadBalancerServiceName string,
 	generatedClusterIPServiceName string,
 	tlsSecretName string,
@@ -140,20 +139,18 @@ func NewImpersonatorConfigController(
 		),
 		withInformer(
 			servicesInformer,
-			pinnipedcontroller.NameAndNamespaceExactMatchFilterFactory(generatedLoadBalancerServiceName, namespace),
+			pinnipedcontroller.SimpleFilterWithSingletonQueue(func(obj metav1.Object) bool {
+				return obj.GetNamespace() == namespace && obj.GetName() == generatedLoadBalancerServiceName
+			}),
 			controllerlib.InformerOption{},
 		),
 		withInformer(
 			secretsInformer,
-			pinnipedcontroller.SimpleFilter(func(obj metav1.Object) bool {
+			pinnipedcontroller.SimpleFilterWithSingletonQueue(func(obj metav1.Object) bool {
 				return obj.GetNamespace() == namespace && secretNames.Has(obj.GetName())
-			}, nil),
+			}),
 			controllerlib.InformerOption{},
 		),
-		// Be sure to run once even if the CredentialIssuer that the informer is watching doesn't exist so we can implement
-		// the default configuration behavior.
-		withInitialEvent(controllerlib.Key{Name: credentialIssuerResourceName}),
-		// TODO fix these controller options to make this a singleton queue
 	)
 }
 
diff --git a/internal/controller/impersonatorconfig/impersonator_config_test.go b/internal/controller/impersonatorconfig/impersonator_config_test.go
index c9dbe9929..349ee9748 100644
--- a/internal/controller/impersonatorconfig/impersonator_config_test.go
+++ b/internal/controller/impersonatorconfig/impersonator_config_test.go
@@ -57,7 +57,6 @@ func TestImpersonatorConfigControllerOptions(t *testing.T) {
 
 		var r *require.Assertions
 		var observableWithInformerOption *testutil.ObservableWithInformerOption
-		var observableWithInitialEventOption *testutil.ObservableWithInitialEventOption
 		var credIssuerInformerFilter controllerlib.Filter
 		var servicesInformerFilter controllerlib.Filter
 		var secretsInformerFilter controllerlib.Filter
@@ -66,7 +65,6 @@ func TestImpersonatorConfigControllerOptions(t *testing.T) {
 		it.Before(func() {
 			r = require.New(t)
 			observableWithInformerOption = testutil.NewObservableWithInformerOption()
-			observableWithInitialEventOption = testutil.NewObservableWithInitialEventOption()
 			pinnipedInformerFactory := pinnipedinformers.NewSharedInformerFactory(nil, 0)
 			sharedInformerFactory := kubeinformers.NewSharedInformerFactory(nil, 0)
 			credIssuerInformer := pinnipedInformerFactory.Config().V1alpha1().CredentialIssuers()
@@ -83,7 +81,6 @@ func TestImpersonatorConfigControllerOptions(t *testing.T) {
 				servicesInformer,
 				secretsInformer,
 				observableWithInformerOption.WithInformer,
-				observableWithInitialEventOption.WithInitialEvent,
 				generatedLoadBalancerServiceName,
 				generatedClusterIPServiceName,
 				tlsSecretName,
@@ -240,14 +237,6 @@ func TestImpersonatorConfigControllerOptions(t *testing.T) {
 				})
 			})
 		})
-
-		when("starting up", func() {
-			it("asks for an initial event because the CredentialIssuer may not exist yet and it needs to run anyway", func() {
-				r.Equal(&controllerlib.Key{
-					Name: credentialIssuerResourceName,
-				}, observableWithInitialEventOption.GetInitialEventKey())
-			})
-		})
 	}, spec.Parallel(), spec.Report(report.Terminal{}))
 }
 
@@ -531,7 +520,6 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
 				kubeInformers.Core().V1().Services(),
 				kubeInformers.Core().V1().Secrets(),
 				controllerlib.WithInformer,
-				controllerlib.WithInitialEvent,
 				loadBalancerServiceName,
 				clusterIPServiceName,
 				tlsSecretName,
diff --git a/internal/controllermanager/prepare_controllers.go b/internal/controllermanager/prepare_controllers.go
index 60c759f91..e6b69ec10 100644
--- a/internal/controllermanager/prepare_controllers.go
+++ b/internal/controllermanager/prepare_controllers.go
@@ -259,7 +259,6 @@ func PrepareControllers(c *Config) (func(ctx context.Context), error) {
 				informers.installationNamespaceK8s.Core().V1().Services(),
 				informers.installationNamespaceK8s.Core().V1().Secrets(),
 				controllerlib.WithInformer,
-				controllerlib.WithInitialEvent,
 				c.NamesConfig.ImpersonationLoadBalancerService,
 				c.NamesConfig.ImpersonationClusterIPService,
 				c.NamesConfig.ImpersonationTLSCertificateSecret,