diff --git a/CHANGELOG.md b/CHANGELOG.md
index e6e2d54..546df32 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,8 @@
+## 0.4.1
+
+BUG FIXES:
+* smallstep_workload.static_sans is a list of strings not a set since the first is used as the Common Name.
+
 ## 0.4.0
 
 FEATURES:
diff --git a/docs/resources/workload.md b/docs/resources/workload.md
index 9d5c560..c28e4bd 100644
--- a/docs/resources/workload.md
+++ b/docs/resources/workload.md
@@ -91,7 +91,7 @@ resource "smallstep_workload" "redis" {
 For example, if the device instance data in the collection is `{"internal_host": "foo.internal", "external_host", "foo.example.com"}` at the time the workload certificate is issued and this field is set to `["internal_host", "external_host"]`, then the certificate would include the SANs `foo.internal` and `foo.example.com`.
 - `hooks` (Attributes) The collection of commands to run when a certificate for a managed endpoint is signed or renewed. (see [below for nested schema](#nestedatt--hooks))
 - `reload_info` (Attributes) The properties used to reload a service. (see [below for nested schema](#nestedatt--reload_info))
-- `static_sans` (Set of String) SANs that will be added to every certificate issued for this workload. The first will be used as the default Common Name.
+- `static_sans` (List of String) SANs that will be added to every certificate issued for this workload. The first will be used as the default Common Name.
 
 ### Read-Only
 
diff --git a/internal/provider/workload/model.go b/internal/provider/workload/model.go
index 18f8cd2..48c6cbf 100644
--- a/internal/provider/workload/model.go
+++ b/internal/provider/workload/model.go
@@ -28,7 +28,7 @@ type Model struct {
 	Hooks                 types.Object `tfsdk:"hooks"`
 	AdminEmails           types.Set    `tfsdk:"admin_emails"`
 	DeviceMetadataKeySANs types.Set    `tfsdk:"device_metadata_key_sans"`
-	StaticSANs            types.Set    `tfsdk:"static_sans"`
+	StaticSANs            types.List   `tfsdk:"static_sans"`
 }
 
 func fromAPI(ctx context.Context, workload *v20230301.Workload, state utils.AttributeGetter) (*Model, diag.Diagnostics) {
@@ -72,7 +72,7 @@ func fromAPI(ctx context.Context, workload *v20230301.Workload, state utils.Attr
 		},
 	}
 
-	model.StaticSANs, d = utils.ToOptionalSet(ctx, workload.StaticSANs, state, path.Root("static_sans"))
+	model.StaticSANs, d = utils.ToOptionalList(ctx, workload.StaticSANs, state, path.Root("static_sans"))
 	diags.Append(d...)
 	if diags.HasError() {
 		return nil, diags
diff --git a/internal/provider/workload/resource.go b/internal/provider/workload/resource.go
index 8fbfdb1..b72cf8a 100644
--- a/internal/provider/workload/resource.go
+++ b/internal/provider/workload/resource.go
@@ -208,7 +208,7 @@ func (r *Resource) Schema(ctx context.Context, req resource.SchemaRequest, resp
 					setplanmodifier.UseStateForUnknown(),
 				},
 			},
-			"static_sans": schema.SetAttribute{
+			"static_sans": schema.ListAttribute{
 				MarkdownDescription: props["staticSANs"],
 				ElementType:         types.StringType,
 				Optional:            true,