diff --git a/Gopkg.lock b/Gopkg.lock
index 7ba3257f..780cf85f 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -142,7 +142,7 @@
 
 [[projects]]
   branch = "master"
-  digest = "1:ea38e7f69c0eac433ce08e27804ab50e9f6b4454cab951ae7cb60d1b5f1e3e92"
+  digest = "1:e6359560ec72d5f3baf4afcd9f46fd3d62b510d3b8aef140f785d9c3d6b8e80a"
   name = "github.com/google/go-containerregistry"
   packages = [
     "pkg/authn",
@@ -162,7 +162,7 @@
     "pkg/v1/v1util",
   ]
   pruneopts = "UT"
-  revision = "11836488c0a2f806544892ad2ff3ed07103e0768"
+  revision = "ca8b66cb1b793f7fb0e3c191ad9a37eb3dc80ea0"
 
 [[projects]]
   branch = "master"
diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go
index 11262f44..813205da 100644
--- a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go
+++ b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go
@@ -77,6 +77,8 @@ func Config(base v1.Image, cfg v1.Config) (v1.Image, error) {
 	}
 
 	cf.Config = cfg
+	// Downstream tooling expects these to match.
+	cf.ContainerConfig = cfg
 
 	return ConfigFile(base, cf)
 }
@@ -468,7 +470,7 @@ func Time(img v1.Image, t time.Time) (v1.Image, error) {
 
 	// Copy basic config over
 	cfg.Config = ocf.Config
-	cfg.ContainerConfig = ocf.ContainerConfig
+	cfg.ContainerConfig = ocf.Config // Downstream tooling expects these to match.
 
 	// Strip away timestamps from the config file
 	cfg.Created = v1.Time{Time: t}