diff --git a/operator/internal/controller/reverseproxyserver_controller.go b/operator/internal/controller/reverseproxyserver_controller.go
index 4f61747..b718359 100644
--- a/operator/internal/controller/reverseproxyserver_controller.go
+++ b/operator/internal/controller/reverseproxyserver_controller.go
@@ -28,6 +28,9 @@ type ReverseProxyServerReconciler struct {
 // +kubebuilder:rbac:groups=minikura.kirameki.cafe,resources=reverseproxyservers,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=minikura.kirameki.cafe,resources=reverseproxyservers/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=minikura.kirameki.cafe,resources=reverseproxyservers/finalizers,verbs=update
+// +kubebuilder:rbac:groups=minikura.kirameki.cafe,resources=minecraftservers,verbs=get;list;watch
+// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups="",resources=services;configmaps,verbs=get;list;watch;create;update;patch;delete
 
 func (r *ReverseProxyServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	var rp v1alpha1.ReverseProxyServer
@@ -182,6 +185,9 @@ func (r *ReverseProxyServerReconciler) proxiesForServer(ctx context.Context, obj
 
 	reqs := make([]reconcile.Request, 0, len(list.Items))
 	for _, rp := range list.Items {
+		if !matchesBackend(rp, obj) {
+			continue
+		}
 		reqs = append(reqs, reconcile.Request{
 			NamespacedName: client.ObjectKey{Name: rp.Name, Namespace: rp.Namespace},
 		})
@@ -189,6 +195,17 @@ func (r *ReverseProxyServerReconciler) proxiesForServer(ctx context.Context, obj
 	return reqs
 }
 
+func matchesBackend(rp v1alpha1.ReverseProxyServer, obj client.Object) bool {
+	if rp.Spec.BackendSelector == nil {
+		return true
+	}
+	selector, err := metav1.LabelSelectorAsSelector(rp.Spec.BackendSelector)
+	if err != nil {
+		return false
+	}
+	return selector.Matches(labels.Set(obj.GetLabels()))
+}
+
 func (r *ReverseProxyServerReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&v1alpha1.ReverseProxyServer{}).
diff --git a/operator/internal/resources/common.go b/operator/internal/resources/common.go
index 32a5b4a..62aa186 100644
--- a/operator/internal/resources/common.go
+++ b/operator/internal/resources/common.go
@@ -90,17 +90,29 @@ func JVMEnv(jvm v1alpha1.JVMOptions, limitMB int32) []corev1.EnvVar {
 }
 
 func UserEnv(base []corev1.EnvVar, extra []v1alpha1.EnvVar) []corev1.EnvVar {
+	index := make(map[string]int, len(base))
+	for i, env := range base {
+		index[env.Name] = i
+	}
 	for _, e := range extra {
+		if i, ok := index[e.Name]; ok {
+			base[i].Value = e.Value
+			continue
+		}
+		index[e.Name] = len(base)
 		base = append(base, corev1.EnvVar{Name: e.Name, Value: e.Value})
 	}
 	return base
 }
 
-func TCPProbe(initialDelay int32) *corev1.Probe {
+func TCPProbe(initialDelay int32, port int32) *corev1.Probe {
+	if port == 0 {
+		port = ContainerPort
+	}
 	return &corev1.Probe{
 		ProbeHandler: corev1.ProbeHandler{
 			TCPSocket: &corev1.TCPSocketAction{
-				Port: intstr.FromInt32(ContainerPort),
+				Port: intstr.FromInt32(port),
 			},
 		},
 		InitialDelaySeconds: initialDelay,
diff --git a/operator/internal/resources/common_test.go b/operator/internal/resources/common_test.go
index d43215c..876bfad 100644
--- a/operator/internal/resources/common_test.go
+++ b/operator/internal/resources/common_test.go
@@ -77,10 +77,10 @@ func TestUserEnvOverridesDefaults(t *testing.T) {
 	base := []corev1.EnvVar{{Name: "TYPE", Value: "VANILLA"}}
 	got := UserEnv(base, []v1alpha1.EnvVar{{Name: "TYPE", Value: "PAPER"}})
 
-	if len(got) != 2 {
-		t.Fatalf("len = %d, want 2", len(got))
+	if len(got) != 1 {
+		t.Fatalf("len = %d, want 1", len(got))
 	}
-	if got[len(got)-1].Value != "PAPER" {
-		t.Errorf("last TYPE = %q, want PAPER", got[len(got)-1].Value)
+	if got[0].Value != "PAPER" {
+		t.Errorf("TYPE = %q, want PAPER", got[0].Value)
 	}
 }
diff --git a/operator/internal/resources/minecraftserver.go b/operator/internal/resources/minecraftserver.go
index 0f6b2e1..6c74d5b 100644
--- a/operator/internal/resources/minecraftserver.go
+++ b/operator/internal/resources/minecraftserver.go
@@ -122,7 +122,7 @@ func minecraftPodSpec(mc *v1alpha1.MinecraftServer, stateful bool) corev1.PodSpe
 			}},
 			Env:            minecraftEnv(mc),
 			VolumeMounts:   mounts,
-			ReadinessProbe: TCPProbe(initialDelay),
+			ReadinessProbe: TCPProbe(initialDelay, ContainerPort),
 			Resources:      ResourceRequirements(mc.Spec.Resources),
 		}},
 		Volumes: volumes,
diff --git a/operator/internal/resources/reverseproxyserver.go b/operator/internal/resources/reverseproxyserver.go
index 3c843d3..c78536e 100644
--- a/operator/internal/resources/reverseproxyserver.go
+++ b/operator/internal/resources/reverseproxyserver.go
@@ -92,15 +92,7 @@ func ProxyDeployment(rp *v1alpha1.ReverseProxyServer) *appsv1.Deployment {
 						VolumeMounts: []corev1.VolumeMount{
 							{Name: "config", MountPath: "/config"},
 						},
-						ReadinessProbe: &corev1.Probe{
-							ProbeHandler: corev1.ProbeHandler{
-								TCPSocket: &corev1.TCPSocketAction{
-									Port: intstr.FromInt32(rp.Spec.ListenPort),
-								},
-							},
-							InitialDelaySeconds: 30,
-							PeriodSeconds:       10,
-						},
+						ReadinessProbe: TCPProbe(30, rp.Spec.ListenPort),
 						Resources: ResourceRequirements(rp.Spec.Resources),
 					}},
 					Volumes: []corev1.Volume{{