diff --git a/internal/service/kubernetes_service.go b/internal/service/kubernetes_service.go
index 81229d68..942c5e17 100644
--- a/internal/service/kubernetes_service.go
+++ b/internal/service/kubernetes_service.go
@@ -201,6 +201,12 @@ func (k *KubernetesService) updateFromItem(item *unstructured.Unstructured) {
 		return
 	}
 
+	if len(hosts) == 0 {
+		k.log.App.Warn().Str("namespace", key.namespace).Str("name", key.name).Msg("No hosts found in ingress, skipping")
+		k.removeIngress(key)
+		return
+	}
+
 	labels, err := decoders.DecodeLabels[model.Apps](annotations, "apps")
 	if err != nil {
 		k.log.App.Warn().Err(err).Str("namespace", key.namespace).Str("name", key.name).Msg("Failed to decode ingress labels, skipping")
@@ -213,35 +219,28 @@ func (k *KubernetesService) updateFromItem(item *unstructured.Unstructured) {
 	v := validators.NewDomainValidator(validators.DomainValidatorOptions{})
 
 	for name, config := range labels.Apps {
-		registerApp := len(hosts) == 0
-
 		if config.Config.Domain != "" {
 			hostname, err := v.SafeHostname(config.Config.Domain)
 			if err != nil {
 				k.log.App.Warn().Err(err).Str("namespace", key.namespace).Str("name", key.name).Str("domain", config.Config.Domain).Msg("Domain is invalid, matching will rely on app name")
 			} else if slices.Contains(hosts, hostname) {
-				registerApp = true
+				entries = append(entries, ingressEntry{
+					name: name,
+					app:  config,
+				})
+				continue
 			}
 		}
 
-		if !registerApp {
-			for _, host := range hosts {
-				if strings.HasPrefix(strings.ToLower(host), strings.ToLower(name+".")) {
-					registerApp = true
-					break
-				}
+		for _, host := range hosts {
+			if strings.HasPrefix(strings.ToLower(host), strings.ToLower(name+".")) {
+				entries = append(entries, ingressEntry{
+					name: name,
+					app:  config,
+				})
+				break
 			}
 		}
-
-		if !registerApp {
-			k.log.App.Warn().Str("namespace", key.namespace).Str("name", name).Str("appName", name).Msg("App name or domain does not match with ingress")
-			continue
-		}
-
-		entries = append(entries, ingressEntry{
-			name: name,
-			app:  config,
-		})
 	}
 
 	if len(entries) == 0 {
diff --git a/internal/service/kubernetes_service_test.go b/internal/service/kubernetes_service_test.go
index ce7b6a79..d1b0b6bc 100644
--- a/internal/service/kubernetes_service_test.go
+++ b/internal/service/kubernetes_service_test.go
@@ -231,6 +231,13 @@ func TestKubernetesService(t *testing.T) {
 					"tinyauth.apps.myapp.config.domain": "myapp.example.com",
 					"tinyauth.apps.myapp.users.allow":   "alice",
 				})
+				item.Object["spec"] = map[string]any{
+					"rules": []any{
+						map[string]any{
+							"host": "myapp.example.com",
+						},
+					},
+				}
 
 				svc.updateFromItem(&item)
 
@@ -248,6 +255,61 @@ func TestKubernetesService(t *testing.T) {
 				assert.Equal(t, "alice", got.Users.Allow)
 			},
 		},
+		{
+			description: "Update from item skips annotations with no hosts",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				item.SetAnnotations(map[string]string{
+					"tinyauth.apps.myapp.config.domain": "myapp.example.com",
+				})
+
+				svc.updateFromItem(&item)
+
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					if app.Config.Domain == "myapp.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
+				assert.Nil(t, got)
+			},
+		},
+		{
+			description: "UpdateFromItem fails when label parsing fails",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				item.SetAnnotations(map[string]string{
+					"tinyauth.apps.myapp.config.domain": "myapp.example.com",
+					"tinyauth.apps.myapp.users.break":   "i-dont-exist",
+				})
+				item.Object["spec"] = map[string]any{
+					"rules": []any{
+						map[string]any{
+							"host": "myapp.example.com",
+						},
+					},
+				}
+
+				svc.updateFromItem(&item)
+
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					if app.Config.Domain == "myapp.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
+
+				require.Nil(t, got)
+			},
+		},
 		{
 			description: "UpdateFromItem with no annotations removes existing cache entries",
 			run: func(t *testing.T, svc *KubernetesService) {