diff --git a/control-plane/api-gateway/cache/consul.go b/control-plane/api-gateway/cache/consul.go
index d3c21d112f..44047b0f31 100644
--- a/control-plane/api-gateway/cache/consul.go
+++ b/control-plane/api-gateway/cache/consul.go
@@ -362,6 +362,9 @@ func (c *Cache) ensurePolicy(client *api.Client, gatewayName string) (string, er
 			if err != nil {
 				return "", err
 			}
+
+			// on an upgrade the cache will be empty so we need to write the policy to the cache
+			c.gatewayNameToPolicy[gatewayName] = existing
 			return existing.ID, nil
 		}
 
@@ -389,6 +392,8 @@ func (c *Cache) ensurePolicy(client *api.Client, gatewayName string) (string, er
 		return "", err
 	}
 
+	// update cache with existing policy
+	c.gatewayNameToPolicy[gatewayName] = existing
 	return existing.ID, nil
 }
 
@@ -429,7 +434,8 @@ func (c *Cache) ensureRole(client *api.Client, gatewayName string) (string, erro
 	}
 
 	if aclRole != nil {
-		return cachedRole.Name, nil
+		c.gatewayNameToRole[gatewayName] = aclRole
+		return aclRole.Name, nil
 	}
 
 	return createRole()