diff --git a/CHANGELOG.md b/CHANGELOG.md
index e1389c363..107f41371 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Internal rework to remove the use generic resource to ease out the migration to Mimir.
 - Remove unused scrape_timeout inhibition.
 
 ## [4.76.0] - 2024-06-03
diff --git a/service/controller/resource/alerting/alertmanagerconfig/client.go b/service/controller/resource/alerting/alertmanagerconfig/client.go
deleted file mode 100644
index 50aa9a9bc..000000000
--- a/service/controller/resource/alerting/alertmanagerconfig/client.go
+++ /dev/null
@@ -1,26 +0,0 @@
-package alertmanagerconfig
-
-import (
-	"context"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	v1 "k8s.io/client-go/kubernetes/typed/core/v1"
-)
-
-type wrappedClient struct {
-	client v1.SecretInterface
-}
-
-func (c wrappedClient) Create(ctx context.Context, o metav1.Object, options metav1.CreateOptions) (metav1.Object, error) {
-	return c.client.Create(ctx, o.(*corev1.Secret), options)
-}
-func (c wrappedClient) Update(ctx context.Context, o metav1.Object, options metav1.UpdateOptions) (metav1.Object, error) {
-	return c.client.Update(ctx, o.(*corev1.Secret), options)
-}
-func (c wrappedClient) Get(ctx context.Context, name string, options metav1.GetOptions) (metav1.Object, error) {
-	return c.client.Get(ctx, name, options)
-}
-func (c wrappedClient) Delete(ctx context.Context, name string, options *metav1.DeleteOptions) error {
-	return c.client.Delete(ctx, name, *options)
-}
diff --git a/service/controller/resource/alerting/alertmanagerconfig/create.go b/service/controller/resource/alerting/alertmanagerconfig/create.go
new file mode 100644
index 000000000..6c4090168
--- /dev/null
+++ b/service/controller/resource/alerting/alertmanagerconfig/create.go
@@ -0,0 +1,39 @@
+package alertmanagerconfig
+
+import (
+	"context"
+
+	"github.com/giantswarm/microerror"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/giantswarm/prometheus-meta-operator/v2/service/controller/resource/resourceutils"
+)
+
+func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
+	desired, err := r.toSecret()
+	if err != nil {
+		return microerror.Mask(err)
+	}
+
+	r.config.Logger.Debugf(ctx, "creating")
+	current, err := r.config.K8sClient.K8sClient().CoreV1().Secrets(desired.GetNamespace()).Get(ctx, desired.GetName(), metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		current, err = r.config.K8sClient.K8sClient().CoreV1().Secrets(desired.GetNamespace()).Create(ctx, desired, metav1.CreateOptions{})
+	}
+
+	if err != nil {
+		return microerror.Mask(err)
+	}
+
+	if r.hasChanged(current, desired) {
+		resourceutils.UpdateMeta(current, desired)
+		_, err = r.config.K8sClient.K8sClient().CoreV1().Secrets(desired.GetNamespace()).Update(ctx, desired, metav1.UpdateOptions{})
+		if err != nil {
+			return microerror.Mask(err)
+		}
+	}
+	r.config.Logger.Debugf(ctx, "created")
+
+	return nil
+}
diff --git a/service/controller/resource/alerting/alertmanagerconfig/delete.go b/service/controller/resource/alerting/alertmanagerconfig/delete.go
new file mode 100644
index 000000000..2a8e7f3fd
--- /dev/null
+++ b/service/controller/resource/alerting/alertmanagerconfig/delete.go
@@ -0,0 +1,24 @@
+package alertmanagerconfig
+
+import (
+	"context"
+
+	"github.com/giantswarm/microerror"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func (r *Resource) EnsureDeleted(ctx context.Context, obj interface{}) error {
+	object := getObjectMeta()
+
+	r.config.Logger.Debugf(ctx, "deleting")
+	err := r.config.K8sClient.K8sClient().CoreV1().Secrets(object.GetNamespace()).Delete(ctx, object.GetName(), metav1.DeleteOptions{})
+	if apierrors.IsNotFound(err) {
+		// fall through
+	} else if err != nil {
+		return microerror.Mask(err)
+	}
+	r.config.Logger.Debugf(ctx, "deleted")
+
+	return nil
+}
diff --git a/service/controller/resource/alerting/alertmanagerconfig/resource.go b/service/controller/resource/alerting/alertmanagerconfig/resource.go
index d6a36191e..6af064a67 100644
--- a/service/controller/resource/alerting/alertmanagerconfig/resource.go
+++ b/service/controller/resource/alerting/alertmanagerconfig/resource.go
@@ -1,7 +1,6 @@
 package alertmanagerconfig
 
 import (
-	"context"
 	"fmt"
 	"net/url"
 	"path"
@@ -14,7 +13,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"github.com/giantswarm/prometheus-meta-operator/v2/pkg/template"
-	"github.com/giantswarm/prometheus-meta-operator/v2/service/controller/resource/generic"
 	"github.com/giantswarm/prometheus-meta-operator/v2/service/key"
 )
 
@@ -40,6 +38,10 @@ type Config struct {
 	SlackApiURL    string
 }
 
+type Resource struct {
+	config Config
+}
+
 type NotificationTemplateData struct {
 	GrafanaAddress    string
 	MimirEnabled      bool
@@ -56,58 +58,34 @@ type AlertmanagerTemplateData struct {
 	MimirEnabled  bool
 }
 
-func New(config Config) (*generic.Resource, error) {
-	clientFunc := func(namespace string) generic.Interface {
-		c := config.K8sClient.K8sClient().CoreV1().Secrets(namespace)
-		return wrappedClient{client: c}
-	}
-
-	c := generic.Config{
-		ClientFunc: clientFunc,
-		Logger:     config.Logger,
-		Name:       Name,
-		GetObjectMeta: func(ctx context.Context, v interface{}) (metav1.ObjectMeta, error) {
-			return getObjectMeta()
-		},
-		GetDesiredObject: func(ctx context.Context, v interface{}) (metav1.Object, error) {
-			return toSecret(config)
-		},
-		HasChangedFunc: hasChanged,
-	}
-
-	r, err := generic.New(c)
-	if err != nil {
-		return nil, microerror.Mask(err)
-	}
+func New(config Config) (*Resource, error) {
+	return &Resource{config}, nil
+}
 
-	return r, nil
+func (r *Resource) Name() string {
+	return Name
 }
 
-func getObjectMeta() (metav1.ObjectMeta, error) {
+func getObjectMeta() metav1.ObjectMeta {
 	return metav1.ObjectMeta{
 		Name:      key.AlertmanagerSecretName(),
 		Namespace: key.MonitoringNamespace,
-	}, nil
-}
-
-func toSecret(config Config) (*corev1.Secret, error) {
-	objectMeta, err := getObjectMeta()
-	if err != nil {
-		return nil, microerror.Mask(err)
 	}
+}
 
-	notificationTemplate, err := renderNotificationTemplate(templateDirectory, config)
+func (r *Resource) toSecret() (*corev1.Secret, error) {
+	notificationTemplate, err := r.renderNotificationTemplate(templateDirectory)
 	if err != nil {
 		return nil, microerror.Mask(err)
 	}
 
-	alertmanagerConfigSecret, err := renderAlertmanagerConfig(templateDirectory, config)
+	alertmanagerConfigSecret, err := r.renderAlertmanagerConfig(templateDirectory)
 	if err != nil {
 		return nil, microerror.Mask(err)
 	}
 
 	secret := &corev1.Secret{
-		ObjectMeta: objectMeta,
+		ObjectMeta: getObjectMeta(),
 		Data: map[string][]byte{
 			"alertmanager.yaml":          alertmanagerConfigSecret,
 			"notification-template.tmpl": notificationTemplate,
@@ -118,11 +96,11 @@ func toSecret(config Config) (*corev1.Secret, error) {
 	return secret, nil
 }
 
-func renderNotificationTemplate(templateDirectory string, config Config) ([]byte, error) {
+func (r *Resource) renderNotificationTemplate(templateDirectory string) ([]byte, error) {
 	templateData := NotificationTemplateData{
-		GrafanaAddress:    config.GrafanaAddress,
-		MimirEnabled:      config.MimirEnabled,
-		PrometheusAddress: fmt.Sprintf("https://%s", config.BaseDomain),
+		GrafanaAddress:    r.config.GrafanaAddress,
+		MimirEnabled:      r.config.MimirEnabled,
+		PrometheusAddress: fmt.Sprintf("https://%s", r.config.BaseDomain),
 	}
 
 	data, err := template.RenderTemplate(templateData, path.Join(templateDirectory, notificationTemplatePath))
@@ -133,8 +111,8 @@ func renderNotificationTemplate(templateDirectory string, config Config) ([]byte
 	return data, nil
 }
 
-func renderAlertmanagerConfig(templateDirectory string, config Config) ([]byte, error) {
-	templateData, err := getTemplateData(config)
+func (r *Resource) renderAlertmanagerConfig(templateDirectory string) ([]byte, error) {
+	templateData, err := r.getTemplateData()
 	if err != nil {
 		return nil, microerror.Mask(err)
 	}
@@ -147,23 +125,23 @@ func renderAlertmanagerConfig(templateDirectory string, config Config) ([]byte,
 	return data, nil
 }
 
-func getTemplateData(config Config) (*AlertmanagerTemplateData, error) {
+func (r *Resource) getTemplateData() (*AlertmanagerTemplateData, error) {
 	opsgenieUrl, err := url.Parse("https://api.opsgenie.com/v2/heartbeats")
 	if err != nil {
 		return nil, err
 	}
-	proxyURL, err := config.Proxy(opsgenieUrl)
+	proxyURL, err := r.config.Proxy(opsgenieUrl)
 	if err != nil {
 		return nil, err
 	}
 
 	d := &AlertmanagerTemplateData{
-		Installation:  config.Installation,
-		OpsgenieKey:   config.OpsgenieKey,
-		Pipeline:      config.Pipeline,
-		SlackApiToken: config.SlackApiToken,
-		SlackApiURL:   config.SlackApiURL,
-		MimirEnabled:  config.MimirEnabled,
+		Installation:  r.config.Installation,
+		OpsgenieKey:   r.config.OpsgenieKey,
+		Pipeline:      r.config.Pipeline,
+		SlackApiToken: r.config.SlackApiToken,
+		SlackApiURL:   r.config.SlackApiURL,
+		MimirEnabled:  r.config.MimirEnabled,
 	}
 
 	if proxyURL != nil {
@@ -173,7 +151,7 @@ func getTemplateData(config Config) (*AlertmanagerTemplateData, error) {
 	return d, nil
 }
 
-func hasChanged(current, desired metav1.Object) bool {
+func (r *Resource) hasChanged(current, desired metav1.Object) bool {
 	c := current.(*corev1.Secret)
 	d := desired.(*corev1.Secret)
 
diff --git a/service/controller/resource/alerting/alertmanagerconfig/resource_test.go b/service/controller/resource/alerting/alertmanagerconfig/resource_test.go
index 16f7079fa..9eb9a21b6 100644
--- a/service/controller/resource/alerting/alertmanagerconfig/resource_test.go
+++ b/service/controller/resource/alerting/alertmanagerconfig/resource_test.go
@@ -19,8 +19,12 @@ func TestRenderingOfAlertmanagerNotificationTemplateWithLegacyMonitoring(t *test
 			Installation:   "test-installation",
 			GrafanaAddress: "https://grafana",
 		}
+		resource, err := New(config)
+		if err != nil {
+			t.Fatal(err)
+		}
 		testFunc = func(v interface{}) (interface{}, error) {
-			return renderNotificationTemplate(unittest.ProjectRoot(), config)
+			return resource.renderNotificationTemplate(unittest.ProjectRoot())
 		}
 	}
 
@@ -59,8 +63,12 @@ func TestRenderingOfAlertmanagerNotificationTemplateWithMimirEnabled(t *testing.
 			MimirEnabled:   true,
 			BaseDomain:     "prometheus.installation-prometheus.svc",
 		}
+		resource, err := New(config)
+		if err != nil {
+			t.Fatal(err)
+		}
 		testFunc = func(v interface{}) (interface{}, error) {
-			return renderNotificationTemplate(unittest.ProjectRoot(), config)
+			return resource.renderNotificationTemplate(unittest.ProjectRoot())
 		}
 	}
 
@@ -104,8 +112,12 @@ func TestRenderingOfAlertmanagerConfigWithLegacyMonitoring(t *testing.T) {
 			Pipeline:       "testing",
 			SlackApiURL:    "https://slack",
 		}
+		resource, err := New(config)
+		if err != nil {
+			t.Fatal(err)
+		}
 		testFunc = func(v interface{}) (interface{}, error) {
-			return renderAlertmanagerConfig(unittest.ProjectRoot(), config)
+			return resource.renderAlertmanagerConfig(unittest.ProjectRoot())
 		}
 	}
 
@@ -150,8 +162,12 @@ func TestRenderingOfAlertmanagerConfigWithMimirEnabled(t *testing.T) {
 			Pipeline:       "testing",
 			SlackApiURL:    "https://slack",
 		}
+		resource, err := New(config)
+		if err != nil {
+			t.Fatal(err)
+		}
 		testFunc = func(v interface{}) (interface{}, error) {
-			return renderAlertmanagerConfig(unittest.ProjectRoot(), config)
+			return resource.renderAlertmanagerConfig(unittest.ProjectRoot())
 		}
 	}
 
@@ -196,8 +212,12 @@ func TestRenderingOfAlertmanagerConfigSlackToken(t *testing.T) {
 			SlackApiURL:    "https://slack",
 			SlackApiToken:  "some-token",
 		}
+		resource, err := New(config)
+		if err != nil {
+			t.Fatal(err)
+		}
 		testFunc = func(v interface{}) (interface{}, error) {
-			return renderAlertmanagerConfig(unittest.ProjectRoot(), config)
+			return resource.renderAlertmanagerConfig(unittest.ProjectRoot())
 		}
 	}
 
diff --git a/service/controller/resource/alerting/heartbeatwebhookconfig/create.go b/service/controller/resource/alerting/heartbeatwebhookconfig/create.go
index f2cbcdc56..4656f5a8f 100644
--- a/service/controller/resource/alerting/heartbeatwebhookconfig/create.go
+++ b/service/controller/resource/alerting/heartbeatwebhookconfig/create.go
@@ -6,6 +6,8 @@ import (
 	"github.com/giantswarm/microerror"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/giantswarm/prometheus-meta-operator/v2/service/controller/resource/resourceutils"
 )
 
 func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
@@ -29,7 +31,7 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 	}
 
 	if r.hasChanged(current, desired) {
-		updateMeta(current, desired)
+		resourceutils.UpdateMeta(current, desired)
 		_, err = r.client.MonitoringV1alpha1().AlertmanagerConfigs(desired.GetNamespace()).Update(ctx, desired, metav1.UpdateOptions{})
 		if err != nil {
 			return microerror.Mask(err)
@@ -39,25 +41,3 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 
 	return nil
 }
-
-func updateMeta(c, d metav1.Object) {
-	d.SetGenerateName(c.GetGenerateName())
-	d.SetUID(c.GetUID())
-	d.SetResourceVersion(c.GetResourceVersion())
-	d.SetGeneration(c.GetGeneration())
-	d.SetSelfLink(c.GetSelfLink())
-	d.SetCreationTimestamp(c.GetCreationTimestamp())
-	d.SetDeletionTimestamp(c.GetDeletionTimestamp())
-	d.SetDeletionGracePeriodSeconds(c.GetDeletionGracePeriodSeconds())
-	// without this, it's impossible to change labels on resources
-	if len(d.GetLabels()) == 0 {
-		d.SetLabels(c.GetLabels())
-	}
-	// without this, it's impossible to change annotations on resources
-	if len(d.GetAnnotations()) == 0 {
-		d.SetAnnotations(c.GetAnnotations())
-	}
-	d.SetFinalizers(c.GetFinalizers())
-	d.SetOwnerReferences(c.GetOwnerReferences())
-	d.SetManagedFields(c.GetManagedFields())
-}
diff --git a/service/controller/resource/certificates/create.go b/service/controller/resource/certificates/create.go
index a81fa3db1..ea8808e4a 100644
--- a/service/controller/resource/certificates/create.go
+++ b/service/controller/resource/certificates/create.go
@@ -6,6 +6,8 @@ import (
 	"github.com/giantswarm/microerror"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/giantswarm/prometheus-meta-operator/v2/service/controller/resource/resourceutils"
 )
 
 func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
@@ -25,7 +27,7 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 	}
 
 	if r.hasChanged(current, desired) {
-		updateMeta(current, desired)
+		resourceutils.UpdateMeta(current, desired)
 		_, err = c.Update(ctx, desired, metav1.UpdateOptions{})
 		if err != nil {
 			return microerror.Mask(err)
@@ -35,19 +37,3 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 
 	return nil
 }
-
-func updateMeta(c, d metav1.Object) {
-	d.SetGenerateName(c.GetGenerateName())
-	d.SetUID(c.GetUID())
-	d.SetResourceVersion(c.GetResourceVersion())
-	d.SetGeneration(c.GetGeneration())
-	d.SetSelfLink(c.GetSelfLink())
-	d.SetCreationTimestamp(c.GetCreationTimestamp())
-	d.SetDeletionTimestamp(c.GetDeletionTimestamp())
-	d.SetDeletionGracePeriodSeconds(c.GetDeletionGracePeriodSeconds())
-	d.SetLabels(c.GetLabels())
-	d.SetAnnotations(c.GetAnnotations())
-	d.SetFinalizers(c.GetFinalizers())
-	d.SetOwnerReferences(c.GetOwnerReferences())
-	d.SetManagedFields(c.GetManagedFields())
-}
diff --git a/service/controller/resource/ciliumnetpol/create.go b/service/controller/resource/ciliumnetpol/create.go
index 420de109a..8a1f10c52 100644
--- a/service/controller/resource/ciliumnetpol/create.go
+++ b/service/controller/resource/ciliumnetpol/create.go
@@ -7,6 +7,8 @@ import (
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	"github.com/giantswarm/prometheus-meta-operator/v2/service/controller/resource/resourceutils"
 )
 
 func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
@@ -32,7 +34,7 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 		}
 
 		if hasCiliumNetworkPolicyChanged(current, desired) {
-			updateMeta(current, desired)
+			resourceutils.UpdateMeta(current, desired)
 			_, err = r.dynamicK8sClient.Resource(resource).Namespace(desired.GetNamespace()).Update(ctx, desired, metav1.UpdateOptions{})
 			if err != nil {
 				return microerror.Mask(err)
@@ -43,19 +45,3 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 
 	return nil
 }
-
-func updateMeta(c, d metav1.Object) {
-	d.SetGenerateName(c.GetGenerateName())
-	d.SetUID(c.GetUID())
-	d.SetResourceVersion(c.GetResourceVersion())
-	d.SetGeneration(c.GetGeneration())
-	d.SetSelfLink(c.GetSelfLink())
-	d.SetCreationTimestamp(c.GetCreationTimestamp())
-	d.SetDeletionTimestamp(c.GetDeletionTimestamp())
-	d.SetDeletionGracePeriodSeconds(c.GetDeletionGracePeriodSeconds())
-	d.SetLabels(c.GetLabels())
-	d.SetAnnotations(c.GetAnnotations())
-	d.SetFinalizers(c.GetFinalizers())
-	d.SetOwnerReferences(c.GetOwnerReferences())
-	d.SetManagedFields(c.GetManagedFields())
-}
diff --git a/service/controller/resource/generic/create.go b/service/controller/resource/generic/create.go
index ef635a9bd..d8e2b6629 100644
--- a/service/controller/resource/generic/create.go
+++ b/service/controller/resource/generic/create.go
@@ -6,6 +6,8 @@ import (
 	"github.com/giantswarm/microerror"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/giantswarm/prometheus-meta-operator/v2/service/controller/resource/resourceutils"
 )
 
 func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
@@ -26,7 +28,7 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 	}
 
 	if r.hasChangedFunc(current, desired) {
-		updateMeta(current, desired)
+		resourceutils.UpdateMeta(current, desired)
 		_, err = c.Update(ctx, desired, metav1.UpdateOptions{})
 		if err != nil {
 			return microerror.Mask(err)
@@ -36,25 +38,3 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 
 	return nil
 }
-
-func updateMeta(c, d metav1.Object) {
-	d.SetGenerateName(c.GetGenerateName())
-	d.SetUID(c.GetUID())
-	d.SetResourceVersion(c.GetResourceVersion())
-	d.SetGeneration(c.GetGeneration())
-	d.SetSelfLink(c.GetSelfLink())
-	d.SetCreationTimestamp(c.GetCreationTimestamp())
-	d.SetDeletionTimestamp(c.GetDeletionTimestamp())
-	d.SetDeletionGracePeriodSeconds(c.GetDeletionGracePeriodSeconds())
-	// without this, it's impossible to change labels on resources
-	if len(d.GetLabels()) == 0 {
-		d.SetLabels(c.GetLabels())
-	}
-	// without this, it's impossible to change annotations on resources
-	if len(d.GetAnnotations()) == 0 {
-		d.SetAnnotations(c.GetAnnotations())
-	}
-	d.SetFinalizers(c.GetFinalizers())
-	d.SetOwnerReferences(c.GetOwnerReferences())
-	d.SetManagedFields(c.GetManagedFields())
-}
diff --git a/service/controller/resource/monitoring/remotewriteapiendpointconfigsecret/create.go b/service/controller/resource/monitoring/remotewriteapiendpointconfigsecret/create.go
index 0bfd2d793..653a44412 100644
--- a/service/controller/resource/monitoring/remotewriteapiendpointconfigsecret/create.go
+++ b/service/controller/resource/monitoring/remotewriteapiendpointconfigsecret/create.go
@@ -9,6 +9,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	remotewriteconfiguration "github.com/giantswarm/prometheus-meta-operator/v2/pkg/remotewrite/configuration"
+	"github.com/giantswarm/prometheus-meta-operator/v2/service/controller/resource/resourceutils"
 	"github.com/giantswarm/prometheus-meta-operator/v2/service/key"
 )
 
@@ -50,7 +51,7 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 				return microerror.Mask(err)
 			}
 			if !reflect.DeepEqual(current.Data, desired.Data) {
-				updateMeta(current, desired)
+				resourceutils.UpdateMeta(current, desired)
 				_, err := r.k8sClient.K8sClient().CoreV1().Secrets(namespace).Update(ctx, desired, metav1.UpdateOptions{})
 				if err != nil {
 					return microerror.Mask(err)
@@ -63,19 +64,3 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 
 	return nil
 }
-
-func updateMeta(c, d metav1.Object) {
-	d.SetGenerateName(c.GetGenerateName())
-	d.SetUID(c.GetUID())
-	d.SetResourceVersion(c.GetResourceVersion())
-	d.SetGeneration(c.GetGeneration())
-	d.SetSelfLink(c.GetSelfLink())
-	d.SetCreationTimestamp(c.GetCreationTimestamp())
-	d.SetDeletionTimestamp(c.GetDeletionTimestamp())
-	d.SetDeletionGracePeriodSeconds(c.GetDeletionGracePeriodSeconds())
-	d.SetLabels(c.GetLabels())
-	d.SetAnnotations(c.GetAnnotations())
-	d.SetFinalizers(c.GetFinalizers())
-	d.SetOwnerReferences(c.GetOwnerReferences())
-	d.SetManagedFields(c.GetManagedFields())
-}
diff --git a/service/controller/resource/monitoring/remotewriteconfig/create.go b/service/controller/resource/monitoring/remotewriteconfig/create.go
index 5c3d7eb4a..8a1e5a52a 100644
--- a/service/controller/resource/monitoring/remotewriteconfig/create.go
+++ b/service/controller/resource/monitoring/remotewriteconfig/create.go
@@ -11,6 +11,7 @@ import (
 	"sigs.k8s.io/yaml"
 
 	remotewriteconfiguration "github.com/giantswarm/prometheus-meta-operator/v2/pkg/remotewrite/configuration"
+	"github.com/giantswarm/prometheus-meta-operator/v2/service/controller/resource/resourceutils"
 	"github.com/giantswarm/prometheus-meta-operator/v2/service/key"
 )
 
@@ -53,7 +54,7 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 				return microerror.Mask(err)
 			}
 			if !reflect.DeepEqual(current.Data, desired.Data) {
-				updateMeta(current, desired)
+				resourceutils.UpdateMeta(current, desired)
 				_, err := r.k8sClient.K8sClient().CoreV1().ConfigMaps(namespace).Update(ctx, desired, metav1.UpdateOptions{})
 				if err != nil {
 					return microerror.Mask(err)
@@ -76,19 +77,3 @@ func readCurrentShardsFromConfig(configMap corev1.ConfigMap) (int, error) {
 
 	return remoteWriteConfig.PrometheusAgentConfig.Shards, nil
 }
-
-func updateMeta(c, d metav1.Object) {
-	d.SetGenerateName(c.GetGenerateName())
-	d.SetUID(c.GetUID())
-	d.SetResourceVersion(c.GetResourceVersion())
-	d.SetGeneration(c.GetGeneration())
-	d.SetSelfLink(c.GetSelfLink())
-	d.SetCreationTimestamp(c.GetCreationTimestamp())
-	d.SetDeletionTimestamp(c.GetDeletionTimestamp())
-	d.SetDeletionGracePeriodSeconds(c.GetDeletionGracePeriodSeconds())
-	d.SetLabels(c.GetLabels())
-	d.SetAnnotations(c.GetAnnotations())
-	d.SetFinalizers(c.GetFinalizers())
-	d.SetOwnerReferences(c.GetOwnerReferences())
-	d.SetManagedFields(c.GetManagedFields())
-}
diff --git a/service/controller/resource/monitoring/remotewritesecret/create.go b/service/controller/resource/monitoring/remotewritesecret/create.go
index adaa8d471..dfcb1b34d 100644
--- a/service/controller/resource/monitoring/remotewritesecret/create.go
+++ b/service/controller/resource/monitoring/remotewritesecret/create.go
@@ -11,6 +11,7 @@ import (
 	"sigs.k8s.io/yaml"
 
 	remotewriteconfiguration "github.com/giantswarm/prometheus-meta-operator/v2/pkg/remotewrite/configuration"
+	"github.com/giantswarm/prometheus-meta-operator/v2/service/controller/resource/resourceutils"
 	"github.com/giantswarm/prometheus-meta-operator/v2/service/key"
 )
 
@@ -50,7 +51,7 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 				return microerror.Mask(err)
 			}
 			if !reflect.DeepEqual(current.Data, desired.Data) {
-				updateMeta(current, desired)
+				resourceutils.UpdateMeta(current, desired)
 				_, err := r.k8sClient.K8sClient().CoreV1().Secrets(namespace).Update(ctx, desired, metav1.UpdateOptions{})
 				if err != nil {
 					return microerror.Mask(err)
@@ -79,19 +80,3 @@ func readRemoteWritePasswordFromSecret(secret corev1.Secret) (string, error) {
 
 	return "", remoteWriteNotFound
 }
-
-func updateMeta(c, d metav1.Object) {
-	d.SetGenerateName(c.GetGenerateName())
-	d.SetUID(c.GetUID())
-	d.SetResourceVersion(c.GetResourceVersion())
-	d.SetGeneration(c.GetGeneration())
-	d.SetSelfLink(c.GetSelfLink())
-	d.SetCreationTimestamp(c.GetCreationTimestamp())
-	d.SetDeletionTimestamp(c.GetDeletionTimestamp())
-	d.SetDeletionGracePeriodSeconds(c.GetDeletionGracePeriodSeconds())
-	d.SetLabels(c.GetLabels())
-	d.SetAnnotations(c.GetAnnotations())
-	d.SetFinalizers(c.GetFinalizers())
-	d.SetOwnerReferences(c.GetOwnerReferences())
-	d.SetManagedFields(c.GetManagedFields())
-}
diff --git a/service/controller/resource/monitoring/verticalpodautoscaler/create.go b/service/controller/resource/monitoring/verticalpodautoscaler/create.go
index f5298b018..a0706a488 100644
--- a/service/controller/resource/monitoring/verticalpodautoscaler/create.go
+++ b/service/controller/resource/monitoring/verticalpodautoscaler/create.go
@@ -6,6 +6,8 @@ import (
 	"github.com/giantswarm/microerror"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/giantswarm/prometheus-meta-operator/v2/service/controller/resource/resourceutils"
 )
 
 func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
@@ -31,7 +33,7 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 	r.logger.Debugf(ctx, "checking if vpa cr needs to be updated")
 	if hasChanged(current, desired) {
 		r.logger.Debugf(ctx, "updating")
-		updateMeta(current, desired)
+		resourceutils.UpdateMeta(current, desired)
 		_, err = r.vpaClient.AutoscalingV1().VerticalPodAutoscalers(desired.GetNamespace()).Update(ctx, desired, metav1.UpdateOptions{})
 		if err != nil {
 			return microerror.Mask(err)
@@ -41,19 +43,3 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 
 	return nil
 }
-
-func updateMeta(c, d metav1.Object) {
-	d.SetGenerateName(c.GetGenerateName())
-	d.SetUID(c.GetUID())
-	d.SetResourceVersion(c.GetResourceVersion())
-	d.SetGeneration(c.GetGeneration())
-	d.SetSelfLink(c.GetSelfLink())
-	d.SetCreationTimestamp(c.GetCreationTimestamp())
-	d.SetDeletionTimestamp(c.GetDeletionTimestamp())
-	d.SetDeletionGracePeriodSeconds(c.GetDeletionGracePeriodSeconds())
-	d.SetLabels(c.GetLabels())
-	d.SetAnnotations(c.GetAnnotations())
-	d.SetFinalizers(c.GetFinalizers())
-	d.SetOwnerReferences(c.GetOwnerReferences())
-	d.SetManagedFields(c.GetManagedFields())
-}
diff --git a/service/controller/resource/rbac/create.go b/service/controller/resource/rbac/create.go
index 12555523d..812da3a98 100644
--- a/service/controller/resource/rbac/create.go
+++ b/service/controller/resource/rbac/create.go
@@ -6,6 +6,8 @@ import (
 	"github.com/giantswarm/microerror"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/giantswarm/prometheus-meta-operator/v2/service/controller/resource/resourceutils"
 )
 
 func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
@@ -25,7 +27,7 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 		}
 
 		if hasClusterRoleBindingChanged(current, desired) {
-			updateMeta(current, desired)
+			resourceutils.UpdateMeta(current, desired)
 			_, err = r.k8sClient.K8sClient().RbacV1().ClusterRoleBindings().Update(ctx, desired, metav1.UpdateOptions{})
 			if err != nil {
 				return microerror.Mask(err)
@@ -36,19 +38,3 @@ func (r *Resource) EnsureCreated(ctx context.Context, obj interface{}) error {
 
 	return nil
 }
-
-func updateMeta(c, d metav1.Object) {
-	d.SetGenerateName(c.GetGenerateName())
-	d.SetUID(c.GetUID())
-	d.SetResourceVersion(c.GetResourceVersion())
-	d.SetGeneration(c.GetGeneration())
-	d.SetSelfLink(c.GetSelfLink())
-	d.SetCreationTimestamp(c.GetCreationTimestamp())
-	d.SetDeletionTimestamp(c.GetDeletionTimestamp())
-	d.SetDeletionGracePeriodSeconds(c.GetDeletionGracePeriodSeconds())
-	d.SetLabels(c.GetLabels())
-	d.SetAnnotations(c.GetAnnotations())
-	d.SetFinalizers(c.GetFinalizers())
-	d.SetOwnerReferences(c.GetOwnerReferences())
-	d.SetManagedFields(c.GetManagedFields())
-}
diff --git a/service/controller/resource/resourceutils/utils.go b/service/controller/resource/resourceutils/utils.go
new file mode 100644
index 000000000..3f8fdaf11
--- /dev/null
+++ b/service/controller/resource/resourceutils/utils.go
@@ -0,0 +1,25 @@
+package resourceutils
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+func UpdateMeta(c, d metav1.Object) {
+	d.SetGenerateName(c.GetGenerateName())
+	d.SetUID(c.GetUID())
+	d.SetResourceVersion(c.GetResourceVersion())
+	d.SetGeneration(c.GetGeneration())
+	d.SetSelfLink(c.GetSelfLink())
+	d.SetCreationTimestamp(c.GetCreationTimestamp())
+	d.SetDeletionTimestamp(c.GetDeletionTimestamp())
+	d.SetDeletionGracePeriodSeconds(c.GetDeletionGracePeriodSeconds())
+	// without this, it's impossible to change labels on resources
+	if len(d.GetLabels()) == 0 {
+		d.SetLabels(c.GetLabels())
+	}
+	// without this, it's impossible to change annotations on resources
+	if len(d.GetAnnotations()) == 0 {
+		d.SetAnnotations(c.GetAnnotations())
+	}
+	d.SetFinalizers(c.GetFinalizers())
+	d.SetOwnerReferences(c.GetOwnerReferences())
+	d.SetManagedFields(c.GetManagedFields())
+}