diff --git a/testsuite/openshift/objects/gateway_api/gateway.py b/testsuite/openshift/objects/gateway_api/gateway.py
index c5f319b4f..52fcc9e52 100644
--- a/testsuite/openshift/objects/gateway_api/gateway.py
+++ b/testsuite/openshift/objects/gateway_api/gateway.py
@@ -122,6 +122,11 @@ def get_tls_cert(self) -> Certificate:
         )
         return tls_cert
 
+    def delete_tls_secret(self):
+        """Deletes secret with TLS certificate used by the gateway"""
+        tls_cert_secret_name = self.model.spec.listeners[0].tls.certificateRefs[0].name
+        self.openshift.get_secret(tls_cert_secret_name).delete(ignore_not_found=True)
+
     def get_spoke_gateway(self, spokes: dict[str, OpenShiftClient]) -> "MGCGateway":
         """
         Returns spoke gateway on an arbitrary, and sometimes, random spoke cluster.
diff --git a/testsuite/tests/mgc/conftest.py b/testsuite/tests/mgc/conftest.py
index bfc9044a1..506810e32 100644
--- a/testsuite/tests/mgc/conftest.py
+++ b/testsuite/tests/mgc/conftest.py
@@ -41,6 +41,7 @@ def upstream_gateway(request, openshift, blame, hostname, module_label):
         placement="http-gateway",
         labels={"app": module_label},
     )
+    request.addfinalizer(upstream_gateway.delete_tls_secret)
     request.addfinalizer(upstream_gateway.delete)
     upstream_gateway.commit()
     # we cannot wait here because of referencing not yet existent tls secret which would be provided later by tlspolicy