diff --git a/src/internal/controller/zitadelcluster_controller.go b/src/internal/controller/zitadelcluster_controller.go
index 943b2cf..d501f07 100644
--- a/src/internal/controller/zitadelcluster_controller.go
+++ b/src/internal/controller/zitadelcluster_controller.go
@@ -51,6 +51,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/util/workqueue"
+	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller"
@@ -315,6 +316,9 @@ func (r *ZitadelClusterReconciler) reconcileSetupJob(ctx context.Context, zitade
 		if !errors.IsNotFound(err) {
 			return ctrl.Result{}, fmt.Errorf("error getting SetupJob: %v", err)
 		}
+		if err := r.scaleDownDeployment(ctx, zitadel); err != nil {
+			return ctrl.Result{}, err
+		}
 		// If job is not found, create the job
 		if err := r.Create(ctx, desiredSetupJob); err != nil {
 			return ctrl.Result{}, fmt.Errorf("error creating SetupJob: %v", err)
@@ -328,6 +332,10 @@ func (r *ZitadelClusterReconciler) reconcileSetupJob(ctx context.Context, zitade
 
 	// If the images don't match, delete the existing job and wait for deletion
 	if existingImage != desiredImage {
+		if err := r.scaleDownDeployment(ctx, zitadel); err != nil {
+			return ctrl.Result{}, err
+		}
+
 		if err := r.Delete(ctx, &existingJob); err != nil {
 			return ctrl.Result{}, fmt.Errorf("error deleting existing SetupJob: %v", err)
 		}
@@ -360,6 +368,25 @@ func (r *ZitadelClusterReconciler) reconcileSetupJob(ctx context.Context, zitade
 	// If the job exists and the image matches, no action is needed
 	return ctrl.Result{}, nil
 }
+func (r *ZitadelClusterReconciler) scaleDownDeployment(ctx context.Context, zitadel *zitadelv1alpha1.ZitadelCluster) error {
+	// scale down deployment first
+	deploymentKey := client.ObjectKeyFromObject(zitadel)
+	var existingDep appsv1.Deployment
+	err := r.Get(ctx, deploymentKey, &existingDep)
+	if err != nil {
+		if errors.IsNotFound(err) {
+		} else {
+			return fmt.Errorf("error getting Deployment: %v", err)
+		}
+	} else {
+		patch := client.MergeFrom(existingDep.DeepCopy())
+		existingDep.Spec.Replicas = ptr.To(int32(0))
+		if err := r.Patch(ctx, &existingDep, patch); err != nil {
+			return fmt.Errorf("Error scaling down deployment: %v", err)
+		}
+	}
+	return nil
+}
 
 func (r *ZitadelClusterReconciler) reconcileDeployment(ctx context.Context, zitadel *zitadelv1alpha1.ZitadelCluster) (ctrl.Result, error) {
 	// TODO: Reload on config changed