diff --git a/src/main/java/io/cryostat/recordings/RecordingMetadataManager.java b/src/main/java/io/cryostat/recordings/RecordingMetadataManager.java
index 5eb159df36..b8d2683aa1 100644
--- a/src/main/java/io/cryostat/recordings/RecordingMetadataManager.java
+++ b/src/main/java/io/cryostat/recordings/RecordingMetadataManager.java
@@ -1032,11 +1032,11 @@ public Metadata(Map<String, String> labels) {
         }
 
         void setSecurityContext(SecurityContext securityContext) {
-            this.securityContext = Objects.requireNonNull(securityContext);
+            this.securityContext = new SecurityContext(Objects.requireNonNull(securityContext));
         }
 
         public SecurityContext getSecurityContext() {
-            return securityContext;
+            return new SecurityContext(securityContext);
         }
 
         public Map<String, String> getLabels() {
@@ -1056,12 +1056,15 @@ public boolean equals(Object o) {
             }
 
             Metadata metadata = (Metadata) o;
-            return new EqualsBuilder().append(labels, metadata.labels).build();
+            return new EqualsBuilder()
+                    .append(labels, metadata.labels)
+                    .append(securityContext, metadata.securityContext)
+                    .build();
         }
 
         @Override
         public int hashCode() {
-            return new HashCodeBuilder().append(labels).toHashCode();
+            return new HashCodeBuilder().append(securityContext).append(labels).toHashCode();
         }
     }
 
@@ -1080,6 +1083,10 @@ private SecurityContext(Map<String, String> ctx) {
             this.ctx = Collections.unmodifiableMap(new HashMap<>(ctx));
         }
 
+        SecurityContext(SecurityContext o) {
+            this.ctx = new HashMap<>(o.ctx);
+        }
+
         public SecurityContext(ServiceRef serviceRef) {
             this.ctx = new HashMap<>();
             // FIXME this should be platform-specific