diff --git a/api/v1beta1/plugin_list.go b/api/v1beta1/plugin_list.go
index 8e99e75c3..1f04c6cd1 100644
--- a/api/v1beta1/plugin_list.go
+++ b/api/v1beta1/plugin_list.go
@@ -4,6 +4,7 @@ import (
 	"crypto/sha256"
 	"fmt"
 	"io"
+	"sort"
 	"strings"
 
 	"github.com/blang/semver"
@@ -30,10 +31,11 @@ func (l PluginList) Hash() string {
 }
 
 func (l PluginList) String() string {
-	plugins := make([]string, 0, len(l))
+	plugins := make(sort.StringSlice, 0, len(l))
 	for _, plugin := range l {
 		plugins = append(plugins, fmt.Sprintf("%s %s", plugin.Name, plugin.Version))
 	}
+	sort.Sort(plugins)
 	return strings.Join(plugins, ",")
 }
 
diff --git a/api/v1beta1/plugin_list_test.go b/api/v1beta1/plugin_list_test.go
new file mode 100644
index 000000000..d0ffa8e38
--- /dev/null
+++ b/api/v1beta1/plugin_list_test.go
@@ -0,0 +1,65 @@
+package v1beta1
+
+import (
+	"strings"
+	"testing"
+	"testing/quick"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPluginString(t *testing.T) {
+	err := quick.Check(func(a string, b string, c string) bool {
+		if strings.Contains(a, ",") || strings.Contains(b, ",") || strings.Contains(c, ",") {
+			return true // skip plugins with ,
+		}
+		pl := PluginList{
+			{
+				Name:    a,
+				Version: "7.2",
+			},
+			{
+				Name:    b,
+				Version: "2.2",
+			},
+			{
+				Name:    c,
+				Version: "6.7",
+			},
+		}
+		out := pl.String()
+		split := strings.Split(out, ",")
+		if len(split) != 3 {
+			return false
+		}
+		if split[0] > split[1] {
+			return false
+		}
+		if split[1] > split[2] {
+			return false
+		}
+		return true
+	}, nil)
+	if err != nil {
+		t.Errorf("plugin list was not sorted: %s", err.Error())
+	}
+}
+
+func TestPluginSanitize(t *testing.T) {
+	pl := PluginList{
+		{
+			Name:    "plugin-a",
+			Version: "1.0.0",
+		},
+		{
+			Name:    "plugin-b",
+			Version: "2.0.0",
+		},
+		{
+			Name:    "plugin-a",
+			Version: "3.0.0",
+		},
+	}
+	sanitized := pl.Sanitize()
+	assert.Len(t, sanitized, 2)
+}