diff --git a/metadata/containers.go b/metadata/containers.go
index 095ab9a1d..a951066ba 100644
--- a/metadata/containers.go
+++ b/metadata/containers.go
@@ -140,6 +140,7 @@ func (s *containerStore) Update(ctx context.Context, container containers.Contai
 	if err := readContainer(&updated, cbkt); err != nil {
 		return updated, errors.Wrapf(err, "failed to read container from bucket")
 	}
+	createdat := updated.CreatedAt
 	updated.ID = container.ID
 
 	// apply the field mask. If you update this code, you better follow the
@@ -178,6 +179,7 @@ func (s *containerStore) Update(ctx context.Context, container containers.Contai
 		updated = container
 	}
 
+	updated.CreatedAt = createdat
 	updated.UpdatedAt = time.Now().UTC()
 	if err := writeContainer(cbkt, &updated); err != nil {
 		return containers.Container{}, errors.Wrap(err, "failed to write container")
diff --git a/metadata/images.go b/metadata/images.go
index 47fc4c167..97e6cc2af 100644
--- a/metadata/images.go
+++ b/metadata/images.go
@@ -136,6 +136,7 @@ func (s *imageStore) Update(ctx context.Context, image images.Image, fieldpaths
 		if err := readImage(&updated, ibkt); err != nil {
 			return errors.Wrapf(err, "image %q", image.Name)
 		}
+		createdat := updated.CreatedAt
 		updated.Name = image.Name
 
 		if len(fieldpaths) > 0 {
@@ -168,7 +169,7 @@ func (s *imageStore) Update(ctx context.Context, image images.Image, fieldpaths
 			updated = image
 		}
 
-		// TODO(stevvooe): Should only mark as updated if we have actual changes.
+		updated.CreatedAt = createdat
 		updated.UpdatedAt = time.Now().UTC()
 		return writeImage(ibkt, &updated)
 	})