diff --git a/pkg/storage/utils/decomposedfs/lookup/lookup.go b/pkg/storage/utils/decomposedfs/lookup/lookup.go
index 95473426158..4769dcc0b4c 100644
--- a/pkg/storage/utils/decomposedfs/lookup/lookup.go
+++ b/pkg/storage/utils/decomposedfs/lookup/lookup.go
@@ -276,7 +276,7 @@ func refFromCS3(b []byte) (*provider.Reference, error) {
 // CopyMetadata copies all extended attributes from source to target.
 // The optional filter function can be used to filter by attribute name, e.g. by checking a prefix
 // For the source file, a shared lock is acquired.
-// NOTE: target resource is not locked! You need to acquire a write lock on the target additionally
+// NOTE: target resource will be write locked!
 func (lu *Lookup) CopyMetadata(src, target string, filter func(attributeName string) bool) (err error) {
 	// Acquire a read log on the source node
 	// write lock existing node before reading treesize or tree time
@@ -302,19 +302,17 @@ func (lu *Lookup) CopyMetadata(src, target string, filter func(attributeName str
 
 // CopyMetadataWithSourceLock copies all extended attributes from source to target.
 // The optional filter function can be used to filter by attribute name, e.g. by checking a prefix
-// For the source file, a shared lock is acquired.
-// NOTE: target resource is not locked! You need to acquire a write lock on the target additionally
-func (lu *Lookup) CopyMetadataWithSourceLock(src, target string, filter func(attributeName string) bool, readLock *lockedfile.File) (err error) {
+// For the source file, a matching lockedfile is required.
+// NOTE: target resource will be write locked!
+func (lu *Lookup) CopyMetadataWithSourceLock(source, target string, filter func(attributeName string) bool, readLock *lockedfile.File) (err error) {
 	switch {
 	case readLock == nil:
 		return errors.New("no lock provided")
-		//case readLock.Path() != filelocks.FlockFile(src):
-		//	return errors.New("lockpath does not match filepath")
-		//case !readLock.Locked() && !readLock.RLocked(): // we need either a read or a write lock
-		//	return errors.New("not locked")
+	case readLock.File.Name() != lu.MetadataBackend().MetadataPath(source):
+		return errors.New("lockpath does not match filepath")
 	}
 
-	attrs, err := lu.metadataBackend.All(src)
+	attrs, err := lu.metadataBackend.All(source)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/storage/utils/decomposedfs/upload/processing.go b/pkg/storage/utils/decomposedfs/upload/processing.go
index bcf639d057b..6027d9fb9e1 100644
--- a/pkg/storage/utils/decomposedfs/upload/processing.go
+++ b/pkg/storage/utils/decomposedfs/upload/processing.go
@@ -334,8 +334,9 @@ func initNewNode(upload *Upload, n *node.Node, fsize uint64) (*lockedfile.File,
 		return nil, err
 	}
 
-	switch upload.lu.MetadataBackend().(type) {
-	case metadata.IniBackend:
+	if _, ok := upload.lu.MetadataBackend().(metadata.IniBackend); ok {
+		// for the ini backend we also need to touch the actual node file here.
+		// it stores the mtime of thge resource, which must not change when we update the ini file
 		h, err := os.OpenFile(n.InternalPath(), os.O_CREATE, 0600)
 		if err != nil {
 			return f, err