diff --git a/addrs/module.go b/addrs/module.go
index fb41ded61..62271b298 100644
--- a/addrs/module.go
+++ b/addrs/module.go
@@ -71,17 +71,7 @@ func (m Module) TargetContains(other Targetable) bool {
 		return true
 
 	case ModuleInstance:
-		if len(to) < len(m) {
-			return false
-		}
-		for i, ourStep := range m {
-			otherStep := to[i]
-			// This is where ModuleInstance differs from Module
-			if ourStep != otherStep.Name {
-				return false
-			}
-		}
-		return true
+		return m.TargetContains(to.Module())
 
 	case AbsResource:
 		return m.TargetContains(to.Module)
diff --git a/addrs/module_instance.go b/addrs/module_instance.go
index 9647e5e5c..40f765ebc 100644
--- a/addrs/module_instance.go
+++ b/addrs/module_instance.go
@@ -391,6 +391,16 @@ func (m ModuleInstance) TargetContains(other Targetable) bool {
 		// Other is contained if its steps match for the length of our own path.
 		for i, ourStep := range m {
 			otherStep := to[i]
+
+			// We can't contain an entire module if we have a specific instance
+			// key. The case of NoKey is OK because this address is either
+			// meant to address an unexpanded module, or a single instance of
+			// that module, and both of those are a covered in-full by the
+			// Module address.
+			if ourStep.InstanceKey != NoKey {
+				return false
+			}
+
 			if ourStep.Name != otherStep {
 				return false
 			}