diff --git a/internal/logs.go b/internal/logs.go
index 4ed4a572e..9f8af0553 100644
--- a/internal/logs.go
+++ b/internal/logs.go
@@ -10,10 +10,10 @@ func MaxSizeSubjectsListForLog(subjects map[string]struct{}, maxToDisplay int) [
 	numberOfNamesToDisplay := min(len(subjects), maxToDisplay)
 	domainsToDisplay := make([]string, 0, numberOfNamesToDisplay)
 	for domain := range subjects {
-		domainsToDisplay = append(domainsToDisplay, domain)
 		if len(domainsToDisplay) >= numberOfNamesToDisplay {
 			break
 		}
+		domainsToDisplay = append(domainsToDisplay, domain)
 	}
 	if len(subjects) > maxToDisplay {
 		domainsToDisplay = append(domainsToDisplay, fmt.Sprintf("(and %d more...)", len(subjects)-maxToDisplay))
diff --git a/internal/ranges_test.go b/internal/ranges_test.go
index fff952283..d9ebd3649 100644
--- a/internal/ranges_test.go
+++ b/internal/ranges_test.go
@@ -90,12 +90,8 @@ func TestMaxSizeSubjectsListForLog(t *testing.T) {
 				"b.com": {},
 			},
 			maxToDisplay: 0,
-			// BUG: When maxToDisplay is 0, code still appends one domain
-			// because append happens before the break check in the loop.
-			// Expected behavior: 1 item (just suffix). Actual: 2 items
-			// (1 leaked domain + suffix).
-			wantLen:    2,
-			wantSuffix: true,
+			wantLen:      1,
+			wantSuffix:   true,
 		},
 		{
 			name: "single subject with max 1",