diff --git a/pkg/operator/ceph/csi/secrets.go b/pkg/operator/ceph/csi/secrets.go
index dec6faf71..7a023770f 100644
--- a/pkg/operator/ceph/csi/secrets.go
+++ b/pkg/operator/ceph/csi/secrets.go
@@ -120,6 +120,9 @@ func createCSIKeyring(
 	allKeyWithBaseName = deduplicate(allKeyWithBaseName)
 
 	currentKeyCount := len(allKeyWithBaseName) - len(keysDeleted)
+	if currentKeyCount <= 0 {
+		logger.Warningf("currentKeyCount is %d is less than or equal to 0; this could be due to an error in key generation", currentKeyCount)
+	}
 
 	return latestClientId, key, currentKeyCount, shouldRotate, nil
 }
@@ -314,7 +317,7 @@ func updateCephStatusWithCephxStatus(context *clusterd.Context, clusterInfo *cli
 			return errors.Wrapf(err, "failed to retrieve cephCluster %q to update CSICephxStatus", namespacedName.Namespace)
 		}
 		cephCluster.Status.Cephx.CSI.CephxStatus = cephxStatus
-		cephCluster.Status.Cephx.CSI.PriorKeyCount = uint8(currentKeyCount) //nolint:gosec // disable G115
+		cephCluster.Status.Cephx.CSI.PriorKeyCount = uint8(getPriorKeyCount(currentKeyCount)) //nolint:gosec // disable G115
 
 		if err := reporting.UpdateStatus(context.Client, cephCluster); err != nil {
 			return errors.Wrapf(err, "failed to update cephCluster %q to update csi cephx status to %q in namespace %q", namespacedName.Name, cephxStatus, namespacedName.Namespace)
@@ -329,6 +332,10 @@ func updateCephStatusWithCephxStatus(context *clusterd.Context, clusterInfo *cli
 	return nil
 }
 
+func getPriorKeyCount(currentKeyCount int) int {
+	return max(0, currentKeyCount-1)
+}
+
 // getCsiKeyRotationInfo runs the `ceph auth ls` command to fetch all the keys and filter out the keys with same base name. Example
 // for base name `client.csi-rbd-node`.
 // From the list of key name return from `getMatchingClient` we'll read the suffix index eg; for key `client.csi-rbd-node.3` we'll take `3` and compare with
diff --git a/pkg/operator/ceph/csi/secrets_test.go b/pkg/operator/ceph/csi/secrets_test.go
index d2893bd22..ebfe71910 100644
--- a/pkg/operator/ceph/csi/secrets_test.go
+++ b/pkg/operator/ceph/csi/secrets_test.go
@@ -522,3 +522,22 @@ func TestParseCsiClient(t *testing.T) {
 		})
 	}
 }
+
+func TestGetPriorKeyCount(t *testing.T) {
+	tests := []struct {
+		name     string
+		keyCount int
+		want     int
+	}{
+		{"keyGen 0", 0, 0},
+		{"keyGen 1", 1, 0},
+		{"keyGen 2", 2, 1},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := getPriorKeyCount(tt.keyCount)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}