diff --git a/bootstrap/kubeadm/types/utils.go b/bootstrap/kubeadm/types/utils.go
index e83b8ce997e0..7e9fb0e02d1d 100644
--- a/bootstrap/kubeadm/types/utils.go
+++ b/bootstrap/kubeadm/types/utils.go
@@ -115,7 +115,8 @@ func marshalForVersion(obj conversion.Hub, version semver.Version, kubeadmObjVer
 	}
 
 	targetKubeadmObj = targetKubeadmObj.DeepCopyObject().(conversion.Convertible)
-	if err := targetKubeadmObj.ConvertFrom(obj); err != nil {
+	// DeepCopy obj because ConvertFrom might have side effects.
+	if err := targetKubeadmObj.ConvertFrom(obj.DeepCopyObject().(conversion.Hub)); err != nil {
 		return "", errors.Wrapf(err, "failed to convert to KubeadmAPI type for version %s", kubeadmAPIGroupVersion)
 	}
 
diff --git a/exp/topology/desiredstate/desired_state.go b/exp/topology/desiredstate/desired_state.go
index 1bb69cb7c0f6..c0f35f29b0dc 100644
--- a/exp/topology/desiredstate/desired_state.go
+++ b/exp/topology/desiredstate/desired_state.go
@@ -547,7 +547,8 @@ func (g *generator) computeControlPlaneVersion(ctx context.Context, s *scope.Sco
 			// hook because we didn't go through an upgrade or we already called the hook after the upgrade.
 			if hooks.IsPending(runtimehooksv1.AfterControlPlaneUpgrade, s.Current.Cluster) {
 				v1beta1Cluster := &clusterv1beta1.Cluster{}
-				if err := v1beta1Cluster.ConvertFrom(s.Current.Cluster); err != nil {
+				// DeepCopy cluster because ConvertFrom has side effects like adding the conversion annotation.
+				if err := v1beta1Cluster.ConvertFrom(s.Current.Cluster.DeepCopy()); err != nil {
 					return "", errors.Wrap(err, "error converting Cluster to v1beta1 Cluster")
 				}
 
@@ -621,7 +622,8 @@ func (g *generator) computeControlPlaneVersion(ctx context.Context, s *scope.Sco
 		// At this point the control plane and the machine deployments are stable and we are almost ready to pick
 		// up the desiredVersion. Call the BeforeClusterUpgrade hook before picking up the desired version.
 		v1beta1Cluster := &clusterv1beta1.Cluster{}
-		if err := v1beta1Cluster.ConvertFrom(s.Current.Cluster); err != nil {
+		// DeepCopy cluster because ConvertFrom has side effects like adding the conversion annotation.
+		if err := v1beta1Cluster.ConvertFrom(s.Current.Cluster.DeepCopy()); err != nil {
 			return "", errors.Wrap(err, "error converting Cluster to v1beta1 Cluster")
 		}
 
diff --git a/internal/controllers/topology/cluster/cluster_controller.go b/internal/controllers/topology/cluster/cluster_controller.go
index 7acbaa7ff853..1d99891c5365 100644
--- a/internal/controllers/topology/cluster/cluster_controller.go
+++ b/internal/controllers/topology/cluster/cluster_controller.go
@@ -432,7 +432,8 @@ func (r *Reconciler) callBeforeClusterCreateHook(ctx context.Context, s *scope.S
 
 	if !s.Current.Cluster.Spec.InfrastructureRef.IsDefined() && !s.Current.Cluster.Spec.ControlPlaneRef.IsDefined() {
 		v1beta1Cluster := &clusterv1beta1.Cluster{}
-		if err := v1beta1Cluster.ConvertFrom(s.Current.Cluster); err != nil {
+		// DeepCopy cluster because ConvertFrom has side effects like adding the conversion annotation.
+		if err := v1beta1Cluster.ConvertFrom(s.Current.Cluster.DeepCopy()); err != nil {
 			return ctrl.Result{}, errors.Wrap(err, "error converting Cluster to v1beta1 Cluster")
 		}
 
@@ -525,7 +526,8 @@ func (r *Reconciler) reconcileDelete(ctx context.Context, cluster *clusterv1.Clu
 	if feature.Gates.Enabled(feature.RuntimeSDK) {
 		if !hooks.IsOkToDelete(cluster) {
 			v1beta1Cluster := &clusterv1beta1.Cluster{}
-			if err := v1beta1Cluster.ConvertFrom(cluster); err != nil {
+			// DeepCopy cluster because ConvertFrom has side effects like adding the conversion annotation.
+			if err := v1beta1Cluster.ConvertFrom(cluster.DeepCopy()); err != nil {
 				return ctrl.Result{}, errors.Wrap(err, "error converting Cluster to v1beta1 Cluster")
 			}
 
diff --git a/internal/controllers/topology/cluster/reconcile_state.go b/internal/controllers/topology/cluster/reconcile_state.go
index aec06232a893..83c285b4f4f9 100644
--- a/internal/controllers/topology/cluster/reconcile_state.go
+++ b/internal/controllers/topology/cluster/reconcile_state.go
@@ -197,7 +197,8 @@ func (r *Reconciler) callAfterControlPlaneInitialized(ctx context.Context, s *sc
 	if hooks.IsPending(runtimehooksv1.AfterControlPlaneInitialized, s.Current.Cluster) {
 		if isControlPlaneInitialized(s.Current.Cluster) {
 			v1beta1Cluster := &clusterv1beta1.Cluster{}
-			if err := v1beta1Cluster.ConvertFrom(s.Current.Cluster); err != nil {
+			// DeepCopy cluster because ConvertFrom has side effects like adding the conversion annotation.
+			if err := v1beta1Cluster.ConvertFrom(s.Current.Cluster.DeepCopy()); err != nil {
 				return errors.Wrap(err, "error converting Cluster to v1beta1 Cluster")
 			}
 
@@ -250,7 +251,8 @@ func (r *Reconciler) callAfterClusterUpgrade(ctx context.Context, s *scope.Scope
 			!s.UpgradeTracker.MachinePools.IsAnyPendingUpgrade() && // No MachinePools are pending an upgrade
 			!s.UpgradeTracker.MachinePools.DeferredUpgrade() { // No MachinePools have deferred an upgrade
 			v1beta1Cluster := &clusterv1beta1.Cluster{}
-			if err := v1beta1Cluster.ConvertFrom(s.Current.Cluster); err != nil {
+			// DeepCopy cluster because ConvertFrom has side effects like adding the conversion annotation.
+			if err := v1beta1Cluster.ConvertFrom(s.Current.Cluster.DeepCopy()); err != nil {
 				return errors.Wrap(err, "error converting Cluster to v1beta1 Cluster")
 			}