diff --git a/client/internal/config.go b/client/internal/config.go
index ba157e2e9ee..baca0a9870b 100644
--- a/client/internal/config.go
+++ b/client/internal/config.go
@@ -230,7 +230,10 @@ func ReadConfig(input ConfigInput) (*Config, error) {
 		config.WgPort = iface.DefaultWgPort
 		refresh = true
 	}
-	if config.WgIface == "" && input.WgIface == "" {
+
+	oldIface := config.WgIface
+
+	if oldIface == "" && input.WgIface == "" {
 		log.Infof("using default Wireguard Interface Name: %#v ", iface.WgInterfaceDefault)
 		config.WgIface = iface.WgInterfaceDefault
 		refresh = true
@@ -249,7 +252,18 @@ func ReadConfig(input ConfigInput) (*Config, error) {
 	}
 
 	if !slices.Contains(config.IFaceBlackList, config.WgIface) {
-		newBlacklist := append([]string{config.WgIface}, config.IFaceBlackList...)
+		var newBlacklist []string
+		replaced := false
+		for _, ifc := range config.IFaceBlackList {
+			if ifc == oldIface {
+				ifc = config.WgIface
+				replaced = true
+			}
+			newBlacklist = append(newBlacklist, ifc)
+		}
+		if !replaced {
+			newBlacklist = append(newBlacklist, config.WgIface)
+		}
 		log.Infof("prepending Wireguard Interface Name to interface blacklist %#v, updated to %v (old value %v)", config.WgIface, newBlacklist, config.IFaceBlackList)
 		config.IFaceBlackList = newBlacklist
 		refresh = true