diff --git a/cdk/assets/grafana_userdata.sh b/cdk/assets/grafana_userdata.sh
index f67ade6..8720329 100644
--- a/cdk/assets/grafana_userdata.sh
+++ b/cdk/assets/grafana_userdata.sh
@@ -52,8 +52,8 @@ INI
 
 # --- sync provisioning + dashboards from S3 (repo is source of truth) ---
 sync_config() {
-  aws s3 sync "s3://${CONFIG_BUCKET}/${CONFIG_PREFIX}/provisioning/" /etc/grafana/provisioning/ --delete
-  aws s3 sync "s3://${CONFIG_BUCKET}/${CONFIG_PREFIX}/dashboards/" /var/lib/grafana/dashboards/ --delete
+  aws s3 sync "s3://${CONFIG_BUCKET}/${CONFIG_PREFIX}/provisioning/" /etc/grafana/provisioning/ --delete --exact-timestamps
+  aws s3 sync "s3://${CONFIG_BUCKET}/${CONFIG_PREFIX}/dashboards/" /var/lib/grafana/dashboards/ --delete --exact-timestamps
   chown -R grafana:grafana /etc/grafana/provisioning /var/lib/grafana/dashboards
 }
 mkdir -p /var/lib/grafana/dashboards
@@ -66,8 +66,8 @@ systemctl enable --now grafana-server
 cat >/usr/local/bin/grafana-config-sync.sh <<SYNC
 #!/bin/bash
 set -euo pipefail
-aws s3 sync "s3://${CONFIG_BUCKET}/${CONFIG_PREFIX}/provisioning/" /etc/grafana/provisioning/ --delete
-aws s3 sync "s3://${CONFIG_BUCKET}/${CONFIG_PREFIX}/dashboards/" /var/lib/grafana/dashboards/ --delete
+aws s3 sync "s3://${CONFIG_BUCKET}/${CONFIG_PREFIX}/provisioning/" /etc/grafana/provisioning/ --delete --exact-timestamps
+aws s3 sync "s3://${CONFIG_BUCKET}/${CONFIG_PREFIX}/dashboards/" /var/lib/grafana/dashboards/ --delete --exact-timestamps
 chown -R grafana:grafana /etc/grafana/provisioning /var/lib/grafana/dashboards
 SYNC
 chmod +x /usr/local/bin/grafana-config-sync.sh