diff --git a/core/src/plugins/kubernetes/container/build/common.ts b/core/src/plugins/kubernetes/container/build/common.ts
index 72189d5061..eea6254b0d 100644
--- a/core/src/plugins/kubernetes/container/build/common.ts
+++ b/core/src/plugins/kubernetes/container/build/common.ts
@@ -20,7 +20,7 @@ import { prepareSecrets } from "../../secrets.js"
 import { Mutagen } from "../../../../mutagen.js"
 import { randomString } from "../../../../util/string.js"
 import type { V1Container, V1Service } from "@kubernetes/client-node"
-import { cloneDeep, isEmpty } from "lodash-es"
+import { cloneDeep, isEmpty, isEqual } from "lodash-es"
 import { compareDeployedResources, waitForResources } from "../../status/status.js"
 import type { KubernetesDeployment, KubernetesResource, KubernetesServiceAccount } from "../../types.js"
 import type { BuildActionHandler, BuildActionResults } from "../../../../plugin/action-types.js"
@@ -313,7 +313,7 @@ export function isEqualAnnotations(r1: KubernetesResource, r2: KubernetesResourc
   // normalize annotations before comparison
   const a1 = r1.metadata.annotations !== undefined ? r1.metadata.annotations : {}
   const a2 = r2.metadata.annotations !== undefined ? r2.metadata.annotations : {}
-  return JSON.stringify(a1) === JSON.stringify(a2)
+  return isEqual(a1, a2)
 }
 
 /**
diff --git a/core/test/integ/src/plugins/kubernetes/container/build/build.ts b/core/test/integ/src/plugins/kubernetes/container/build/build.ts
index 64c01f26bf..e3d45158c6 100644
--- a/core/test/integ/src/plugins/kubernetes/container/build/build.ts
+++ b/core/test/integ/src/plugins/kubernetes/container/build/build.ts
@@ -642,7 +642,7 @@ describe("Ensure serviceAccount annotations for in-cluster building", () => {
         log,
       })
       // Both annotations should be present
-      expect(isEqualAnnotations(originalServiceAccount, status.remoteResources[0]))
+      expect(isEqualAnnotations(originalServiceAccount, status.remoteResources[0])).to.be.true
 
       const reducedAnnotations = {
         "iam.gke.io/gcp-service-account": "workload-identity-gar@garden-ci.iam.gserviceaccount.com",
@@ -660,7 +660,7 @@ describe("Ensure serviceAccount annotations for in-cluster building", () => {
         log,
       })
       // Only reduced annotations should be present
-      expect(isEqualAnnotations(updatedServiceAccount, updatedStatus.remoteResources[0]))
+      expect(isEqualAnnotations(updatedServiceAccount, updatedStatus.remoteResources[0])).to.be.true
     })
     it("should cycle the util deployment when the serviceAccount annotations changed", async () => {
       const originalAnnotations = {
@@ -678,7 +678,7 @@ describe("Ensure serviceAccount annotations for in-cluster building", () => {
       provider.config.kaniko = { serviceAccountAnnotations: updatedAnnotations }
       const { updated } = await ensureUtilDeployment({ ctx, provider, log, api, namespace: projectNamespace })
 
-      expect(updated)
+      expect(updated).to.be.true
     })
   })
 
@@ -740,7 +740,7 @@ describe("Ensure serviceAccount annotations for in-cluster building", () => {
       provider.config.clusterBuildkit = { serviceAccountAnnotations: updatedAnnotations, cache: defaultCacheConfig }
       const { updated } = await ensureBuildkit({ ctx, provider, log: garden.log, api, namespace: projectNamespace })
 
-      expect(updated)
+      expect(updated).to.be.true
     })
   })
 })