diff --git a/pkg/action/upgrade.go b/pkg/action/upgrade.go
index 85904124b..8310cb4be 100644
--- a/pkg/action/upgrade.go
+++ b/pkg/action/upgrade.go
@@ -661,6 +661,13 @@ func mergeCustomLabels(current, desired map[string]string) map[string]string {
 			delete(labels, k)
 		}
 	}
+	// current comes from the previously stored release, which the k8s
+	// drivers (unlike Get) return with system labels still attached; strip
+	// them here so they don't ride along into the new release's Labels and
+	// clobber the fresh createdAt/modifiedAt set when it's persisted.
+	for _, k := range driver.GetSystemLabels() {
+		delete(labels, k)
+	}
 	return labels
 }
 
diff --git a/pkg/action/upgrade_test.go b/pkg/action/upgrade_test.go
index 53419b6a8..44e682127 100644
--- a/pkg/action/upgrade_test.go
+++ b/pkg/action/upgrade_test.go
@@ -477,6 +477,10 @@ func TestMergeCustomLabels(t *testing.T) {
 		{map[string]string{"k1": "v1", "k2": "v2"}, nil, map[string]string{"k1": "v1", "k2": "v2"}},
 		{nil, map[string]string{"k1": "v1", "k2": "v2"}, map[string]string{"k1": "v1", "k2": "v2"}},
 		{map[string]string{"k1": "v1", "k2": "v2"}, map[string]string{"k1": "null", "k2": "v3"}, map[string]string{"k2": "v3"}},
+		// current can carry stale system labels forward from a previous
+		// revision (the k8s drivers' List/Query don't filter them like Get
+		// does); they must never end up in the merged result.
+		{map[string]string{"k1": "v1", "createdAt": "111", "owner": "helm"}, map[string]string{"k2": "v2"}, map[string]string{"k1": "v1", "k2": "v2"}},
 	}
 	for _, test := range tests {
 		output := mergeCustomLabels(test[0], test[1])