diff --git a/internal/databroker/config_source.go b/internal/databroker/config_source.go
index 0b3396ddd..3f6ec2570 100644
--- a/internal/databroker/config_source.go
+++ b/internal/databroker/config_source.go
@@ -2,9 +2,12 @@ package databroker
 
 import (
 	"context"
+	"sort"
 	"sync"
 	"time"
 
+	"golang.org/x/exp/maps"
+
 	"github.com/pomerium/pomerium/config"
 	"github.com/pomerium/pomerium/internal/hashutil"
 	"github.com/pomerium/pomerium/internal/log"
@@ -92,8 +95,13 @@ func (src *ConfigSource) rebuild(ctx context.Context, firstTime firstTime) {
 
 	var additionalPolicies []config.Policy
 
+	ids := maps.Keys(src.dbConfigs)
+	sort.Strings(ids)
+
 	// add all the config policies to the list
-	for id, cfgpb := range src.dbConfigs {
+	for _, id := range ids {
+		cfgpb := src.dbConfigs[id]
+
 		cfg.Options.ApplySettings(ctx, cfgpb.Settings)
 		var errCount uint64