diff --git a/authentik/sources/ldap/api.py b/authentik/sources/ldap/api.py
index e5391149a..a0c280727 100644
--- a/authentik/sources/ldap/api.py
+++ b/authentik/sources/ldap/api.py
@@ -27,10 +27,10 @@ class LDAPSourceSerializer(SourceSerializer):
         """Check that only a single source has password_sync on"""
         sync_users_password = attrs.get("sync_users_password", True)
         if sync_users_password:
-            filter = LDAPSource.objects.filter(sync_users_password=True)
+            sources = LDAPSource.objects.filter(sync_users_password=True)
             if self.instance:
-                filter = filter.exclude(pk=self.instance.pk)
-            if filter.exists():
+                sources = sources.exclude(pk=self.instance.pk)
+            if sources.exists():
                 raise ValidationError(
                     "Only a single LDAP Source with password synchronization is allowed"
                 )
diff --git a/web/src/pages/sources/ldap/LDAPSourceForm.ts b/web/src/pages/sources/ldap/LDAPSourceForm.ts
index f468f88c9..85b286b1f 100644
--- a/web/src/pages/sources/ldap/LDAPSourceForm.ts
+++ b/web/src/pages/sources/ldap/LDAPSourceForm.ts
@@ -213,7 +213,7 @@ export class LDAPSourceForm extends ModelForm<LDAPSource, string> {
                             ${until(
                                 new PropertymappingsApi(DEFAULT_CONFIG)
                                     .propertymappingsLdapList({
-                                        ordering: "object_field",
+                                        ordering: "managed,object_field",
                                     })
                                     .then((mappings) => {
                                         return mappings.results.map((mapping) => {