diff --git a/pkg/storage/driver/cfgmaps.go b/pkg/storage/driver/cfgmaps.go
index 3e4acfd81..8f1f60c5c 100644
--- a/pkg/storage/driver/cfgmaps.go
+++ b/pkg/storage/driver/cfgmaps.go
@@ -78,7 +78,7 @@ func (cfgmaps *ConfigMaps) Get(key string) (*rspb.Release, error) {
 		slog.Debug("failed to decode data", "key", key, slog.Any("error", err))
 		return nil, err
 	}
-	r.Labels = filterSystemLabels(obj.ObjectMeta.Labels)
+	r.Labels = obj.ObjectMeta.Labels
 	// return the release object
 	return r, nil
 }
@@ -244,9 +244,9 @@ func newConfigMapsObject(key string, rls *rspb.Release, lbs labels) (*v1.ConfigM
 	}
 
 	// apply custom labels
-	lbs.fromMap(rls.Labels)
+	lbs.fromMap(filterSystemLabels(rls.Labels))
 
-	// apply labels
+	// apply system labels
 	lbs.set("name", rls.Name)
 	lbs.set("owner", owner)
 	lbs.set("status", rls.Info.Status.String())
diff --git a/pkg/storage/driver/cfgmaps_test.go b/pkg/storage/driver/cfgmaps_test.go
index 8ba6832fa..e99e3e61c 100644
--- a/pkg/storage/driver/cfgmaps_test.go
+++ b/pkg/storage/driver/cfgmaps_test.go
@@ -46,6 +46,7 @@ func TestConfigMapGet(t *testing.T) {
 		t.Fatalf("Failed to get release: %s", err)
 	}
 	// compare fetched release with original
+	got.Labels = filterSystemLabels(got.Labels)
 	if !reflect.DeepEqual(rel, got) {
 		t.Errorf("Expected {%v}, got {%v}", rel, got)
 	}
@@ -78,6 +79,7 @@ func TestUncompressedConfigMapGet(t *testing.T) {
 		t.Fatalf("Failed to get release: %s", err)
 	}
 	// compare fetched release with original
+	got.Labels = filterSystemLabels(got.Labels)
 	if !reflect.DeepEqual(rel, got) {
 		t.Errorf("Expected {%v}, got {%v}", rel, got)
 	}
@@ -185,6 +187,7 @@ func TestConfigMapCreate(t *testing.T) {
 	}
 
 	// compare created release with original
+	got.Labels = filterSystemLabels(got.Labels)
 	if !reflect.DeepEqual(rel, got) {
 		t.Errorf("Expected {%v}, got {%v}", rel, got)
 	}
@@ -239,6 +242,7 @@ func TestConfigMapDelete(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Failed to delete release with key %q: %s", key, err)
 	}
+	rls.Labels = filterSystemLabels(rls.Labels)
 	if !reflect.DeepEqual(rel, rls) {
 		t.Errorf("Expected {%v}, got {%v}", rel, rls)
 	}
diff --git a/pkg/storage/driver/secrets.go b/pkg/storage/driver/secrets.go
index a69f1ed65..53492ef01 100644
--- a/pkg/storage/driver/secrets.go
+++ b/pkg/storage/driver/secrets.go
@@ -72,7 +72,7 @@ func (secrets *Secrets) Get(key string) (*rspb.Release, error) {
 	}
 	// found the secret, decode the base64 data string
 	r, err := decodeRelease(string(obj.Data["release"]))
-	r.Labels = filterSystemLabels(obj.ObjectMeta.Labels)
+	r.Labels = obj.ObjectMeta.Labels
 	return r, errors.Wrapf(err, "get: failed to decode data %q", key)
 }
 
@@ -226,9 +226,9 @@ func newSecretsObject(key string, rls *rspb.Release, lbs labels) (*v1.Secret, er
 	}
 
 	// apply custom labels
-	lbs.fromMap(rls.Labels)
+	lbs.fromMap(filterSystemLabels(rls.Labels))
 
-	// apply labels
+	// apply system labels
 	lbs.set("name", rls.Name)
 	lbs.set("owner", owner)
 	lbs.set("status", rls.Info.Status.String())
diff --git a/pkg/storage/driver/secrets_test.go b/pkg/storage/driver/secrets_test.go
index 7affc81ab..ede49b6f4 100644
--- a/pkg/storage/driver/secrets_test.go
+++ b/pkg/storage/driver/secrets_test.go
@@ -46,6 +46,7 @@ func TestSecretGet(t *testing.T) {
 		t.Fatalf("Failed to get release: %s", err)
 	}
 	// compare fetched release with original
+	got.Labels = filterSystemLabels(got.Labels)
 	if !reflect.DeepEqual(rel, got) {
 		t.Errorf("Expected {%v}, got {%v}", rel, got)
 	}
@@ -78,6 +79,7 @@ func TestUNcompressedSecretGet(t *testing.T) {
 		t.Fatalf("Failed to get release: %s", err)
 	}
 	// compare fetched release with original
+	got.Labels = filterSystemLabels(got.Labels)
 	if !reflect.DeepEqual(rel, got) {
 		t.Errorf("Expected {%v}, got {%v}", rel, got)
 	}
@@ -184,7 +186,12 @@ func TestSecretCreate(t *testing.T) {
 		t.Fatalf("Failed to get release with key %q: %s", key, err)
 	}
 
+	// check release has actually been created
+	if _, exists := got.Labels["createdAt"]; !exists {
+		t.Errorf("Expected field %s", "createdAt")
+	}
 	// compare created release with original
+	got.Labels = filterSystemLabels(got.Labels)
 	if !reflect.DeepEqual(rel, got) {
 		t.Errorf("Expected {%v}, got {%v}", rel, got)
 	}
@@ -217,6 +224,9 @@ func TestSecretUpdate(t *testing.T) {
 	if rel.Info.Status != got.Info.Status {
 		t.Errorf("Expected status %s, got status %s", rel.Info.Status.String(), got.Info.Status.String())
 	}
+	if _, exists := got.Labels["modifiedAt"]; !exists {
+		t.Errorf("Expected field %s", "modifiedAt")
+	}
 }
 
 func TestSecretDelete(t *testing.T) {
@@ -239,6 +249,7 @@ func TestSecretDelete(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Failed to delete release with key %q: %s", key, err)
 	}
+	rls.Labels = filterSystemLabels(rls.Labels)
 	if !reflect.DeepEqual(rel, rls) {
 		t.Errorf("Expected {%v}, got {%v}", rel, rls)
 	}