diff --git a/pkg/server/stream/v3/stream.go b/pkg/server/stream/v3/stream.go
index 1664a941e0..8d21bfb637 100644
--- a/pkg/server/stream/v3/stream.go
+++ b/pkg/server/stream/v3/stream.go
@@ -1,6 +1,8 @@
 package stream
 
 import (
+	"maps"
+
 	"google.golang.org/grpc"
 
 	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
@@ -99,7 +101,7 @@ func (s *StreamState) SetWildcard(wildcard bool) {
 
 // GetResourceVersions returns a map of current resources grouped by type URL.
 func (s *StreamState) GetResourceVersions() map[string]string {
-	return s.resourceVersions
+	return maps.Clone(s.resourceVersions)
 }
 
 // SetResourceVersions sets a list of resource versions by type URL and removes the flag
diff --git a/pkg/server/stream/v3/stream_test.go b/pkg/server/stream/v3/stream_test.go
new file mode 100644
index 0000000000..9e8b25193b
--- /dev/null
+++ b/pkg/server/stream/v3/stream_test.go
@@ -0,0 +1,25 @@
+package stream
+
+import "testing"
+
+func TestStreamStateUpdateNoReace(t *testing.T) {
+	state := NewStreamState(false, map[string]string{
+		"resource": "1",
+	})
+	// simulate server side update resource from 1->2 finished, sending response
+	nextVersion2 := state.GetResourceVersions()
+	nextVersion2["resource"] = "2"
+
+	// simulate server side update resource from 2->3 finished, sending response
+	nextVersion3 := state.GetResourceVersions()
+	nextVersion3["resource"] = "3"
+
+	// 1->2 response sent to client, update sate
+	state.SetResourceVersions(nextVersion2)
+
+	// should updated to 2, not 3, because 3 not sent yet
+	result := state.GetResourceVersions()
+	if result["resource"] != "2" {
+		t.Errorf("expected version updated to 2, got %v", result["resource"])
+	}
+}