diff --git a/.changeset/empty-trains-complain.md b/.changeset/empty-trains-complain.md
new file mode 100644
index 0000000000..7efd02310c
--- /dev/null
+++ b/.changeset/empty-trains-complain.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend-module-ldap': patch
+---
+
+Make sure to clone objects sent to `ldapjs` since the library modifies them
diff --git a/plugins/catalog-backend-module-ldap/src/ldap/client.ts b/plugins/catalog-backend-module-ldap/src/ldap/client.ts
index ea13ba49ee..91fbd87c39 100644
--- a/plugins/catalog-backend-module-ldap/src/ldap/client.ts
+++ b/plugins/catalog-backend-module-ldap/src/ldap/client.ts
@@ -16,6 +16,7 @@
 
 import { ForwardedError } from '@backstage/errors';
 import ldap, { Client, SearchEntry, SearchOptions } from 'ldapjs';
+import { cloneDeep } from 'lodash';
 import { Logger } from 'winston';
 import { BindConfig } from './config';
 import { errorString } from './util';
@@ -85,7 +86,9 @@ export class LdapClient {
       }, 5000);
 
       const search = new Promise<SearchEntry[]>((resolve, reject) => {
-        this.client.search(dn, options, (err, res) => {
+        // Note that we clone the (frozen) options, since ldapjs rudely tries to
+        // overwrite parts of them
+        this.client.search(dn, cloneDeep(options), (err, res) => {
           if (err) {
             reject(new Error(errorString(err)));
             return;
@@ -137,7 +140,9 @@ export class LdapClient {
   ): Promise<void> {
     try {
       return await new Promise<void>((resolve, reject) => {
-        this.client.search(dn, options, (err, res) => {
+        // Note that we clone the (frozen) options, since ldapjs rudely tries to
+        // overwrite parts of them
+        this.client.search(dn, cloneDeep(options), (err, res) => {
           if (err) {
             reject(new Error(errorString(err)));
           }