diff --git a/UPGRADING.md b/UPGRADING.md
index 30c61af9d4..063e345579 100644
--- a/UPGRADING.md
+++ b/UPGRADING.md
@@ -151,3 +151,7 @@ helm upgrade --install nmap secureCodeBox/nmap --set=cascadingRules.enabled=true
 
 ➡️  [Reference: #1347](https://github.com/secureCodeBox/secureCodeBox/pull/1347)
 
+
+### Service Autodiscovery - Managed-by label assumed to be presented for all scans
+Old versions of the operator did not set `app.kubernetes.io/managed-by` label. Starting with V4 the service autodiscovery will assume every scheduled scan created by the autodiscovery will have this label. This means that older scheduled scans without the label will not be detected by the service autodiscovery and new duplicate scheduled scans will be created. Old scheduled scans without the `app.kubernetes.io/managed-by` label must be deleted manually.  
+➡️  [Reference: #1349](https://github.com/secureCodeBox/secureCodeBox/pull/1349)
\ No newline at end of file
diff --git a/auto-discovery/kubernetes/controllers/service_scan_controller.go b/auto-discovery/kubernetes/controllers/service_scan_controller.go
index 440f5d9939..548cd3cd83 100644
--- a/auto-discovery/kubernetes/controllers/service_scan_controller.go
+++ b/auto-discovery/kubernetes/controllers/service_scan_controller.go
@@ -119,6 +119,7 @@ func (r *ServiceScanReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 		versionedLabels := map[string]string{
 			"auto-discovery.securecodebox.io/target-service": service.Name,
 			"auto-discovery.securecodebox.io/target-port":    fmt.Sprintf("%d", host.Port),
+			"app.kubernetes.io/managed-by":                   "securecodebox-autodiscovery",
 		}
 		for containerName, podDigest := range podDigests {
 			// The map should only contain one entry at this point. As the reconciler breaks (see containerDigestsAllMatch) if the services points to a list pods with different digests per container name
@@ -155,8 +156,6 @@ func (r *ServiceScanReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 			// service was never scanned
 			log.Info("Discovered new unscanned service, scanning it now", "service", service.Name, "namespace", service.Namespace)
 
-			// label is added after the initial query as it was added later and isn't guaranteed to be on every auto-discovery managed scan.
-			versionedLabels["app.kubernetes.io/managed-by"] = "securecodebox-autodiscovery"
 			versionedLabels = generateScanLabels(versionedLabels, r.Config.ServiceAutoDiscoveryConfig.ScanConfig, templateArgs)
 
 			// No scan for this pod digest yet. Scanning now