diff --git a/flux_local/git_repo.py b/flux_local/git_repo.py
index 7383c0d3..ec03cd77 100644
--- a/flux_local/git_repo.py
+++ b/flux_local/git_repo.py
@@ -507,16 +507,6 @@ async def kustomization_traversal(
                 _LOGGER.debug("Already visited %s", path)
                 continue
             visited_paths.add(path)
-
-            _LOGGER.debug("BEFORE: %s", visit_ks)
-            if visit_ks is not None and visit_ks.postbuild_substitute_from:
-                _LOGGER.debug("Expand: %s", cluster_config)
-                values.expand_postbuild_substitute_reference(
-                    visit_ks,
-                    cluster_config,
-                )
-                _LOGGER.debug("AFTER: %s", visit_ks)
-
             tasks.append(visit_kustomization(selector, builder, path, visit_ks))
 
         # Find new kustomizations
@@ -543,6 +533,12 @@ async def kustomization_traversal(
             if not (ks_path := adjust_ks_path(ks, selector)):
                 continue
             ks.path = str(ks_path)
+            if ks.postbuild_substitute_from:
+                values.expand_postbuild_substitute_reference(
+                    ks,
+                    cluster_config,
+                )
+
             path_queue.append((ks_path, ks))
             response_kustomizations.append(ks)
 
@@ -746,7 +742,7 @@ async def update_kustomization(cluster: Cluster) -> None:
                         )
                         # Clear the cache to remove any previous builds that are
                         # missing the postbuild substitutions.
-                        # builder.remove(kustomization)
+                        builder.remove(kustomization)
 
                     build_tasks.append(
                         build_kustomization(
diff --git a/tests/__snapshots__/test_git_repo.ambr b/tests/__snapshots__/test_git_repo.ambr
index ecb85149..835d560a 100644
--- a/tests/__snapshots__/test_git_repo.ambr
+++ b/tests/__snapshots__/test_git_repo.ambr
@@ -952,6 +952,7 @@
     "Cluster 'tests/testdata/cluster'": dict({
       "Build 'flux-system/apps'": dict({
         'cmds': list([
+          'flux build tests/testdata/cluster/apps/prod (abs)',
           "kustomize cfg grep 'kind=^(CustomResourceDefinition|Secret)$' --invert-match",
           "kustomize cfg grep 'kind=^(ConfigMap|HelmRepository|HelmRelease|Secret|ClusterPolicy)$'",
         ]),
diff --git a/tests/tool/__snapshots__/test_build.ambr b/tests/tool/__snapshots__/test_build.ambr
index e7c88458..a124c4b2 100644
--- a/tests/tool/__snapshots__/test_build.ambr
+++ b/tests/tool/__snapshots__/test_build.ambr
@@ -2740,6 +2740,47 @@
     annotations:
       config.kubernetes.io/index: '2'
       internal.config.kubernetes.io/index: '2'
+  ---
+  apiVersion: cert-manager.io/v1
+  kind: Certificate
+  metadata:
+    labels:
+      kustomize.toolkit.fluxcd.io/name: apps
+      kustomize.toolkit.fluxcd.io/namespace: flux-system
+    name: example-com-staging
+    annotations:
+      config.kubernetes.io/index: '3'
+      internal.config.kubernetes.io/index: '3'
+  spec:
+    commonName: example.com
+    dnsNames:
+    - example.com
+    - '*.example.com'
+    issuerRef:
+      kind: ClusterIssuer
+      name: letsencrypt-staging
+    secretName: example-com-staging-tls
+  ---
+  apiVersion: cert-manager.io/v1
+  kind: Certificate
+  metadata:
+    labels:
+      kustomize.toolkit.fluxcd.io/name: apps
+      kustomize.toolkit.fluxcd.io/namespace: flux-system
+    name: other-com-staging
+    annotations:
+      config.kubernetes.io/index: '4'
+      internal.config.kubernetes.io/index: '4'
+  spec:
+    commonName: other.com
+    dnsNames:
+    - other.com
+    - '*.other.com'
+    - example-value
+    issuerRef:
+      kind: ClusterIssuer
+      name: letsencrypt-staging
+    secretName: other-com-staging-tls
   
   ---
   apiVersion: kustomize.toolkit.fluxcd.io/v1
@@ -2811,6 +2852,8 @@
   ---
   apiVersion: v1
   data:
+    SECRET_DOMAIN: example.com
+    SECRET_DOMAIN2: other.com
     cluster_label: example-value
   kind: ConfigMap
   metadata:
diff --git a/tests/tool/__snapshots__/test_diff_ks.ambr b/tests/tool/__snapshots__/test_diff_ks.ambr
index 399df79b..3baf67e2 100644
--- a/tests/tool/__snapshots__/test_diff_ks.ambr
+++ b/tests/tool/__snapshots__/test_diff_ks.ambr
@@ -1,57 +1,6 @@
 # serializer version: 1
 # name: test_diff_ks[apps]
-  '''
-  --- tests/testdata/cluster/apps/prod Kustomization: flux-system/apps Certificate: flux-system/example-com-staging
-  
-  +++ tests/testdata/cluster/apps/prod Kustomization: flux-system/apps Certificate: flux-system/example-com-staging
-  
-  @@ -0,0 +1,18 @@
-  
-  +---
-  +apiVersion: cert-manager.io/v1
-  +kind: Certificate
-  +metadata:
-  +  labels:
-  +    kustomize.toolkit.fluxcd.io/name: apps
-  +    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  +  name: example-com-staging
-  +spec:
-  +  commonName: example.com
-  +  dnsNames:
-  +  - example.com
-  +  - '*.example.com'
-  +  issuerRef:
-  +    kind: ClusterIssuer
-  +    name: letsencrypt-staging
-  +  secretName: example-com-staging-tls
-  +
-  --- tests/testdata/cluster/apps/prod Kustomization: flux-system/apps Certificate: flux-system/other-com-staging
-  
-  +++ tests/testdata/cluster/apps/prod Kustomization: flux-system/apps Certificate: flux-system/other-com-staging
-  
-  @@ -0,0 +1,19 @@
-  
-  +---
-  +apiVersion: cert-manager.io/v1
-  +kind: Certificate
-  +metadata:
-  +  labels:
-  +    kustomize.toolkit.fluxcd.io/name: apps
-  +    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  +  name: other-com-staging
-  +spec:
-  +  commonName: other.com
-  +  dnsNames:
-  +  - other.com
-  +  - '*.other.com'
-  +  - example-value
-  +  issuerRef:
-  +    kind: ClusterIssuer
-  +    name: letsencrypt-staging
-  +  secretName: other-com-staging-tls
-  +
-  
-  '''
+  ''
 # ---
 # name: test_diff_ks[ks-external]
   ''
@@ -121,7 +70,7 @@
         -  values:
         -    ingress:
         -      additionalLabels:
-        -        cluster_label: null
+        -        cluster_label: example-value
         -      className: nginx
         -      enabled: true
         -      hosts:
@@ -157,6 +106,65 @@
         -  name: podinfo-config
         -  namespace: podinfo
         -
+    - kustomization_path: tests/testdata/cluster/apps/prod
+      kind: Certificate
+      namespace: flux-system
+      name: example-com-staging
+      diff: |-
+        --- tests/testdata/cluster/apps/prod Kustomization: flux-system/apps Certificate: flux-system/example-com-staging
+  
+        +++ tests/testdata/cluster/apps/prod Kustomization: flux-system/apps Certificate: flux-system/example-com-staging
+  
+        @@ -1,18 +0,0 @@
+  
+        ----
+        -apiVersion: cert-manager.io/v1
+        -kind: Certificate
+        -metadata:
+        -  labels:
+        -    kustomize.toolkit.fluxcd.io/name: apps
+        -    kustomize.toolkit.fluxcd.io/namespace: flux-system
+        -  name: example-com-staging
+        -spec:
+        -  commonName: example.com
+        -  dnsNames:
+        -  - example.com
+        -  - '*.example.com'
+        -  issuerRef:
+        -    kind: ClusterIssuer
+        -    name: letsencrypt-staging
+        -  secretName: example-com-staging-tls
+        -
+    - kustomization_path: tests/testdata/cluster/apps/prod
+      kind: Certificate
+      namespace: flux-system
+      name: other-com-staging
+      diff: |-
+        --- tests/testdata/cluster/apps/prod Kustomization: flux-system/apps Certificate: flux-system/other-com-staging
+  
+        +++ tests/testdata/cluster/apps/prod Kustomization: flux-system/apps Certificate: flux-system/other-com-staging
+  
+        @@ -1,19 +0,0 @@
+  
+        ----
+        -apiVersion: cert-manager.io/v1
+        -kind: Certificate
+        -metadata:
+        -  labels:
+        -    kustomize.toolkit.fluxcd.io/name: apps
+        -    kustomize.toolkit.fluxcd.io/namespace: flux-system
+        -  name: other-com-staging
+        -spec:
+        -  commonName: other.com
+        -  dnsNames:
+        -  - other.com
+        -  - '*.other.com'
+        -  - example-value
+        -  issuerRef:
+        -    kind: ClusterIssuer
+        -    name: letsencrypt-staging
+        -  secretName: other-com-staging-tls
+        -
   
   
   '''