diff --git a/hack/tools/internal/tilt-prepare/main.go b/hack/tools/internal/tilt-prepare/main.go
index 277fa4710a71..31739857f41e 100644
--- a/hack/tools/internal/tilt-prepare/main.go
+++ b/hack/tools/internal/tilt-prepare/main.go
@@ -834,12 +834,15 @@ func prepareWorkload(name, prefix, binaryName, containerName string, objs []unst
 				}
 				finalArgs = append(finalArgs, a)
 			}
-
-			container.Ports = append(container.Ports, corev1.ContainerPort{
-				Name:          "metrics",
-				ContainerPort: 8080,
-				Protocol:      "TCP",
-			})
+			// tilt-prepare should add the metrics port if and only if it's missing:
+			// as best practices with controller-runtime, it's named metrics and listening on port 8080.
+			if !containerHasMetricsPort(container.Ports) {
+				container.Ports = append(container.Ports, corev1.ContainerPort{
+					Name:          "metrics",
+					ContainerPort: 8080,
+					Protocol:      corev1.ProtocolTCP,
+				})
+			}
 
 			container.Command = cmd
 			container.Args = finalArgs
@@ -848,6 +851,16 @@ func prepareWorkload(name, prefix, binaryName, containerName string, objs []unst
 	})
 }
 
+func containerHasMetricsPort(ports []corev1.ContainerPort) bool {
+	for _, port := range ports {
+		if port.ContainerPort == 8080 && port.Name == "metrics" && port.Protocol == corev1.ProtocolTCP {
+			return true
+		}
+	}
+
+	return false
+}
+
 type updateDeploymentFunction func(deployment *appsv1.Deployment)
 
 // updateDeployment passes all (typed) deployments to the updateDeploymentFunction