diff --git a/controllers/openstackmachine_controller.go b/controllers/openstackmachine_controller.go
index 3ed0e9f847..f2ce1a24a4 100644
--- a/controllers/openstackmachine_controller.go
+++ b/controllers/openstackmachine_controller.go
@@ -554,8 +554,13 @@ func openStackMachineSpecToOpenStackServerSpec(openStackMachineSpec *infrav1.Ope
 
 	// If not ports are provided we create one.
 	// Ports must have a network so if none is provided we use the default network.
-	serverPorts := openStackMachineSpec.Ports
-	if len(openStackMachineSpec.Ports) == 0 {
+	var serverPorts []infrav1.PortOpts
+	if len(openStackMachineSpec.Ports) > 0 {
+		serverPorts = make([]infrav1.PortOpts, len(openStackMachineSpec.Ports))
+		for i := range openStackMachineSpec.Ports {
+			openStackMachineSpec.Ports[i].DeepCopyInto(&serverPorts[i])
+		}
+	} else {
 		serverPorts = make([]infrav1.PortOpts, 1)
 	}
 
diff --git a/controllers/openstackmachine_controller_test.go b/controllers/openstackmachine_controller_test.go
index b9497c8efe..7fba8bcf0f 100644
--- a/controllers/openstackmachine_controller_test.go
+++ b/controllers/openstackmachine_controller_test.go
@@ -385,6 +385,10 @@ func TestOpenStackMachineSpecToOpenStackServerSpec(t *testing.T) {
 	for i := range tests {
 		tt := tests[i]
 		t.Run(tt.name, func(t *testing.T) {
+			var specCopy *infrav1.OpenStackMachineSpec
+			if tt.spec != nil {
+				specCopy = tt.spec.DeepCopy()
+			}
 			spec, err := openStackMachineSpecToOpenStackServerSpec(tt.spec, identityRef, tags, "", userData, &openStackCluster.Status.WorkerSecurityGroup.ID, tt.cluster)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("openStackMachineSpecToOpenStackServerSpec() error = %v, wantErr %v", err, tt.wantErr)
@@ -393,6 +397,9 @@ func TestOpenStackMachineSpecToOpenStackServerSpec(t *testing.T) {
 			if !tt.wantErr && !reflect.DeepEqual(spec, tt.want) {
 				t.Errorf("openStackMachineSpecToOpenStackServerSpec() got = %+v, want %+v", spec, tt.want)
 			}
+			if tt.spec != nil && !reflect.DeepEqual(tt.spec, specCopy) {
+				t.Errorf("openStackMachineSpecToOpenStackServerSpec() mutated the input spec! before: %+v, after: %+v", specCopy, tt.spec)
+			}
 		})
 	}
 }