diff --git a/.editorconfig b/.editorconfig
index 2a5b1f870..b80ea6f1a 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -12,3 +12,6 @@ indent_size = 2
 
 [*.{yaml,yml}]
 indent_size = 2
+
+[*.go]
+indent_style = tab
diff --git a/internal/outpost/ldap/entries.go b/internal/outpost/ldap/entries.go
index 9912188f9..af389f27d 100644
--- a/internal/outpost/ldap/entries.go
+++ b/internal/outpost/ldap/entries.go
@@ -30,11 +30,15 @@ func (pi *ProviderInstance) UserEntry(u api.User) *ldap.Entry {
 	// Only append attributes that don't already exist
 	// TODO: Remove in 2023.3
 	for _, rawAttr := range rawAttrs {
+		exists := false
 		for _, attr := range attrs {
-			if !strings.EqualFold(attr.Name, rawAttr.Name) {
-				attrs = append(attrs, rawAttr)
+			if strings.EqualFold(attr.Name, rawAttr.Name) {
+				exists = true
 			}
 		}
+		if !exists {
+			attrs = append(attrs, rawAttr)
+		}
 	}
 
 	if u.IsActive == nil {
diff --git a/internal/outpost/ldap/group/group.go b/internal/outpost/ldap/group/group.go
index 089be6ebb..dc48f4a39 100644
--- a/internal/outpost/ldap/group/group.go
+++ b/internal/outpost/ldap/group/group.go
@@ -36,11 +36,15 @@ func (lg *LDAPGroup) Entry() *ldap.Entry {
 	// Only append attributes that don't already exist
 	// TODO: Remove in 2023.3
 	for _, rawAttr := range rawAttrs {
+		exists := false
 		for _, attr := range attrs {
-			if !strings.EqualFold(attr.Name, rawAttr.Name) {
-				attrs = append(attrs, rawAttr)
+			if strings.EqualFold(attr.Name, rawAttr.Name) {
+				exists = true
 			}
 		}
+		if !exists {
+			attrs = append(attrs, rawAttr)
+		}
 	}
 
 	objectClass := []string{constants.OCGroup, constants.OCGroupOfUniqueNames, constants.OCGroupOfNames, constants.OCAKGroup, constants.OCPosixGroup}