diff --git a/internal/servers/controller/interceptor.go b/internal/servers/controller/interceptor.go
index 5fd96e14c..13c8c1413 100644
--- a/internal/servers/controller/interceptor.go
+++ b/internal/servers/controller/interceptor.go
@@ -241,7 +241,10 @@ func auditRequestInterceptor(
 		handler grpc.UnaryHandler) (interface{}, error,
 	) {
 		if msg, ok := req.(proto.Message); ok {
-			if err := event.WriteAudit(interceptorCtx, op, event.WithRequest(&event.Request{Details: msg})); err != nil {
+			// Clone the request before writing it to the audit log,
+			// in case downstream interceptors modify it.
+			clonedMsg := proto.Clone(msg)
+			if err := event.WriteAudit(interceptorCtx, op, event.WithRequest(&event.Request{Details: clonedMsg})); err != nil {
 				return req, status.Errorf(codes.Internal, "unable to write request msg audit: %s", err)
 			}
 		}
@@ -263,7 +266,10 @@ func auditResponseInterceptor(
 		resp, err := handler(interceptorCtx, req)
 
 		if msg, ok := resp.(proto.Message); ok {
-			if err := event.WriteAudit(interceptorCtx, op, event.WithResponse(&event.Response{Details: msg})); err != nil {
+			// Clone the response before writing it to the audit log,
+			// in case downstream interceptors modify it.
+			clonedMsg := proto.Clone(msg)
+			if err := event.WriteAudit(interceptorCtx, op, event.WithResponse(&event.Response{Details: clonedMsg})); err != nil {
 				return req, status.Errorf(codes.Internal, "unable to write response msg audit: %s", err)
 			}
 		}