diff --git a/CHANGELOG.md b/CHANGELOG.md
index 894e166c..721e83ab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ Changelog for Cass Operator, new PRs should update the `main / unreleased` secti
 * [FEATURE] Task scheduler support to allow creating tasks that run for each pod in the cluster. The tasks have their own reconciliation process and lifecycle distinct from CassandraDatacenter as well as their own API package.
 * [ENHANCEMENT] [#235](https://github.com/k8ssandra/cass-operator/issues/235) Adding AdditionalLabels to add on all resources managed by the operator
 * [ENHANCEMENT] [#244](https://github.com/k8ssandra/cass-operator/issues/244) Add ability to skip Cassandra user creation
+* [BUGFIX] [#254](https://github.com/k8ssandra/cass-operator/pull/254) Safely set annotation on datacenter in config secret
 * [ENHANCEMENT] [#257](https://github.com/k8ssandra/cass-operator/issues/257) Add management-api client method to list schema versions
 
 ## v.1.9.0
diff --git a/pkg/reconciliation/reconcile_configsecret.go b/pkg/reconciliation/reconcile_configsecret.go
index d910c2a2..3d9ba13a 100644
--- a/pkg/reconciliation/reconcile_configsecret.go
+++ b/pkg/reconciliation/reconcile_configsecret.go
@@ -105,7 +105,7 @@ func (rc *ReconciliationContext) updateConfigHashAnnotation(secret *corev1.Secre
 	b64Hash := base64.StdEncoding.EncodeToString(hashBytes)
 
 	patch := client.MergeFrom(rc.Datacenter.DeepCopy())
-	rc.Datacenter.Annotations[api.ConfigHashAnnotation] = b64Hash
+	metav1.SetMetaDataAnnotation(&rc.Datacenter.ObjectMeta, api.ConfigHashAnnotation, b64Hash)
 
 	return rc.Client.Patch(rc.Ctx, rc.Datacenter, patch)
 }