diff --git a/sunbeam-python/sunbeam/features/ldap/feature.py b/sunbeam-python/sunbeam/features/ldap/feature.py
index b50d6329c..c6aebbaed 100644
--- a/sunbeam-python/sunbeam/features/ldap/feature.py
+++ b/sunbeam-python/sunbeam/features/ldap/feature.py
@@ -47,6 +47,16 @@
 APPLICATION_DEPLOY_TIMEOUT = 900  # 15 minutes
 APPLICATION_REMOVE_TIMEOUT = 300  # 5 minutes
 
+# The LDAP steps reapply the whole OpenStack plan, which reverts any
+# out-of-band charm config (e.g. Traefik TLS set with juju config) as
+# drift. Restrict the apply to the LDAP domain resources only.
+# See LP#2159042.
+LDAP_APPLY_TARGETS = [
+    "-target=juju_application.ldap-apps",
+    "-target=juju_integration.ldap-apps-to-logging",
+    "-target=juju_integration.ldap-to-keystone",
+]
+
 
 class DisableLDAPDomainStep(BaseStep, JujuStepHelper):
     """Generic step to enable OpenStack application using Terraform."""
@@ -95,7 +105,7 @@ def run(self, context: StepContext) -> Result:
         update_config(self.client, config_key, tfvars)
 
         try:
-            self.tfhelper.apply(reporter=context.reporter)
+            self.tfhelper.apply(LDAP_APPLY_TARGETS, reporter=context.reporter)
         except TerraformException as e:
             return Result(ResultType.FAILED, str(e))
 
@@ -163,7 +173,7 @@ def run(self, context: StepContext) -> Result:
         update_config(self.client, config_key, tfvars)
 
         try:
-            self.tfhelper.apply(reporter=context.reporter)
+            self.tfhelper.apply(LDAP_APPLY_TARGETS, reporter=context.reporter)
         except TerraformException as e:
             return Result(ResultType.FAILED, str(e))
         charm_name = "keystone-ldap-{}".format(self.charm_config["domain-name"])
@@ -233,7 +243,7 @@ def run(self, context: StepContext) -> Result:
         update_config(self.client, config_key, tfvars)
 
         try:
-            self.tfhelper.apply(reporter=context.reporter)
+            self.tfhelper.apply(LDAP_APPLY_TARGETS, reporter=context.reporter)
         except TerraformException as e:
             return Result(ResultType.FAILED, str(e))
         charm_name = "keystone-ldap-{}".format(self.charm_config["domain-name"])
diff --git a/sunbeam-python/tests/unit/sunbeam/features/test_ldap.py b/sunbeam-python/tests/unit/sunbeam/features/test_ldap.py
index 92d8b8481..13a1c9643 100644
--- a/sunbeam-python/tests/unit/sunbeam/features/test_ldap.py
+++ b/sunbeam-python/tests/unit/sunbeam/features/test_ldap.py
@@ -9,6 +9,7 @@
 from sunbeam.core.terraform import TerraformException
 from sunbeam.features.interface.v1.openstack import TerraformPlanLocation
 from sunbeam.features.ldap.feature import (
+    LDAP_APPLY_TARGETS,
     AddLDAPDomainStep,
     DisableLDAPDomainStep,
     LDAPFeature,
@@ -71,7 +72,9 @@ def test_enable_first_domain(self, read_config, update_config, snap, step_contex
                 "ldap-apps": {"dom1": {"domain-name": "dom1"}},
             }
         )
-        step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
+        step.tfhelper.apply.assert_called_once_with(
+            LDAP_APPLY_TARGETS, reporter=step_context.reporter
+        )
         assert result.result_type == ResultType.COMPLETED
 
     def test_enable_second_domain(self, read_config, update_config, snap, step_context):
@@ -90,7 +93,9 @@ def test_enable_second_domain(self, read_config, update_config, snap, step_conte
                 },
             }
         )
-        step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
+        step.tfhelper.apply.assert_called_once_with(
+            LDAP_APPLY_TARGETS, reporter=step_context.reporter
+        )
         assert result.result_type == ResultType.COMPLETED
 
     def test_enable_tf_apply_failed(
@@ -120,7 +125,9 @@ def test_enable_waiting_timed_out(
                 "ldap-apps": {"dom1": {"domain-name": "dom1"}},
             }
         )
-        step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
+        step.tfhelper.apply.assert_called_once_with(
+            LDAP_APPLY_TARGETS, reporter=step_context.reporter
+        )
         assert result.result_type == ResultType.FAILED
         assert result.message == "timed out"
 
@@ -150,7 +157,9 @@ def test_disable(self, read_config, update_config, snap, step_context):
         step.tfhelper.write_tfvars.assert_called_with(
             {"ldap-channel": "2023.2/edge", "ldap-apps": {}}
         )
-        step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
+        step.tfhelper.apply.assert_called_once_with(
+            LDAP_APPLY_TARGETS, reporter=step_context.reporter
+        )
 
     def test_disable_tf_apply_failed(
         self, read_config, update_config, snap, step_context
@@ -165,7 +174,9 @@ def test_disable_tf_apply_failed(
         step.tfhelper.write_tfvars.assert_called_with(
             {"ldap-channel": "2023.2/edge", "ldap-apps": {}}
         )
-        step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
+        step.tfhelper.apply.assert_called_once_with(
+            LDAP_APPLY_TARGETS, reporter=step_context.reporter
+        )
         assert result.result_type == ResultType.FAILED
         assert result.message == "apply failed..."
 
@@ -214,7 +225,9 @@ def test_update_domain(self, read_config, update_config, snap, step_context):
                 "ldap-apps": {"dom1": {"domain-name": "dom1"}},
             }
         )
-        step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
+        step.tfhelper.apply.assert_called_once_with(
+            LDAP_APPLY_TARGETS, reporter=step_context.reporter
+        )
         assert result.result_type == ResultType.COMPLETED
 
     def test_update_wrong_domain(self, read_config, update_config, snap, step_context):
@@ -239,7 +252,9 @@ def test_tf_apply_failed(self, read_config, update_config, snap, step_context):
         )
         step.tfhelper.apply.side_effect = TerraformException("apply failed...")
         result = step.run(step_context)
-        step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
+        step.tfhelper.apply.assert_called_once_with(
+            LDAP_APPLY_TARGETS, reporter=step_context.reporter
+        )
         assert result.result_type == ResultType.FAILED
         assert result.message == "apply failed..."
 
@@ -256,6 +271,8 @@ def test_update_waiting_timed_out(
         self.jhelper.wait_until_active.side_effect = TimeoutError("timed out")
         step.tfhelper.apply.side_effect = TerraformException("apply failed...")
         result = step.run(step_context)
-        step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
+        step.tfhelper.apply.assert_called_once_with(
+            LDAP_APPLY_TARGETS, reporter=step_context.reporter
+        )
         assert result.result_type == ResultType.FAILED
         assert result.message == "apply failed..."