diff --git a/mkosi.finalize b/mkosi.finalize
new file mode 100755
index 0000000000..e6aededc60
--- /dev/null
+++ b/mkosi.finalize
@@ -0,0 +1,5 @@
+#!/bin/bash
+# SPDX-License-Identifier: CC-0
+set -e
+
+touch -r "$BUILDROOT/usr" "$BUILDROOT/etc/.updated" "$BUILDROOT/var/.updated"