diff --git a/VERSION b/VERSION
index c906c61..a33ca21 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-v0.1.15-dev
\ No newline at end of file
+v0.1.16
\ No newline at end of file
diff --git a/charts/control-plane-operator/Chart.yaml b/charts/control-plane-operator/Chart.yaml
index e346fb6..28a4073 100644
--- a/charts/control-plane-operator/Chart.yaml
+++ b/charts/control-plane-operator/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: control-plane-operator
 description: A Helm chart for the Cloud Orchestration Control Plane Operator
 type: application
-version: v0.1.15
-appVersion: v0.1.15
+version: v0.1.16
+appVersion: v0.1.16
 home: https://github.com/openmcp-project/control-plane-operator
 sources:
   - https://github.com/openmcp-project/control-plane-operator
diff --git a/charts/control-plane-operator/values.yaml b/charts/control-plane-operator/values.yaml
index efc4402..7f3ddfa 100644
--- a/charts/control-plane-operator/values.yaml
+++ b/charts/control-plane-operator/values.yaml
@@ -8,7 +8,7 @@ image:
   repository: ghcr.io/openmcp-project/images/control-plane-operator
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v0.1.15
+  tag: v0.1.16
 
 imagePullSecrets: []
 nameOverride: ""
diff --git a/internal/controller/controlplane_controller.go b/internal/controller/controlplane_controller.go
index b76f852..88edb4c 100644
--- a/internal/controller/controlplane_controller.go
+++ b/internal/controller/controlplane_controller.go
@@ -48,8 +48,10 @@ import (
 	"k8s.io/client-go/tools/record"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	corev1beta1 "github.com/openmcp-project/control-plane-operator/api/v1beta1"
 	"github.com/openmcp-project/control-plane-operator/pkg/controlplane/components"
@@ -191,6 +193,9 @@ func (r *ControlPlaneReconciler) getReleaseChannels(ctx context.Context) corev1b
 func (r *ControlPlaneReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&corev1beta1.ControlPlane{}).
+		WithOptions(controller.TypedOptions[reconcile.Request]{
+			MaxConcurrentReconciles: 10,
+		}).
 		Complete(r)
 }
 
diff --git a/internal/controller/kubeconfigs.go b/internal/controller/kubeconfigs.go
index a5d970e..fef7de3 100644
--- a/internal/controller/kubeconfigs.go
+++ b/internal/controller/kubeconfigs.go
@@ -41,8 +41,13 @@ func (r *ControlPlaneReconciler) ensureKubeconfig(ctx context.Context, remoteCfg
 			return nil, err
 		}
 
+		remainingLifetime := time.Until(expiration)
+
 		// check if token would expire before next planned reconciliation
-		if time.Now().Before(expiration.Add(-r.ReconcilePeriod)) {
+		// or less than a third of the desired lifetime is left
+		expired := remainingLifetime < r.ReconcilePeriod || remainingLifetime < r.FluxTokenLifetime/3
+
+		if !expired {
 			// kubeconfig is still valid
 			return &corev1.SecretReference{Name: secret.Name, Namespace: secret.Namespace}, nil
 		}