diff --git a/pkg/cloudprovider/cloudprovider.go b/pkg/cloudprovider/cloudprovider.go
index 7968faffa844..3cec17461804 100644
--- a/pkg/cloudprovider/cloudprovider.go
+++ b/pkg/cloudprovider/cloudprovider.go
@@ -118,7 +118,7 @@ func (c *CloudProvider) Create(ctx context.Context, nodeClaim *karpv1.NodeClaim)
 		return i.Name == instance.Type
 	})
 	nc := c.instanceToNodeClaim(instance, instanceType, nodeClass)
-	nc.Annotations = lo.Assign(nodeClass.Annotations, map[string]string{
+	nc.Annotations = lo.Assign(nc.Annotations, map[string]string{
 		v1.AnnotationKubeletCompatibilityHash: kubeletHash,
 		v1.AnnotationEC2NodeClassHash:         nodeClass.Hash(),
 		v1.AnnotationEC2NodeClassHashVersion:  v1.EC2NodeClassHashVersion,
diff --git a/pkg/cloudprovider/suite_test.go b/pkg/cloudprovider/suite_test.go
index 16d0a8298e9a..8056d2f23374 100644
--- a/pkg/cloudprovider/suite_test.go
+++ b/pkg/cloudprovider/suite_test.go
@@ -249,6 +249,14 @@ var _ = Describe("CloudProvider", func() {
 		Expect(ok).To(BeTrue())
 		Expect(zoneID).To(Equal(subnet.ZoneID))
 	})
+	It("should expect a strict set of annotation keys", func() {
+		ExpectApplied(ctx, env.Client, nodePool, nodeClass, nodeClaim)
+		cloudProviderNodeClaim, err := cloudProvider.Create(ctx, nodeClaim)
+		Expect(err).To(BeNil())
+		Expect(cloudProviderNodeClaim).ToNot(BeNil())
+		Expect(len(lo.Keys(cloudProviderNodeClaim.Annotations))).To(BeNumerically("==", 3))
+		Expect(lo.Keys(cloudProviderNodeClaim.Annotations)).To(ContainElements(v1.AnnotationKubeletCompatibilityHash, v1.AnnotationEC2NodeClassHash, v1.AnnotationEC2NodeClassHashVersion))
+	})
 	It("should return NodeClass Hash on the nodeClaim", func() {
 		ExpectApplied(ctx, env.Client, nodePool, nodeClass, nodeClaim)
 		cloudProviderNodeClaim, err := cloudProvider.Create(ctx, nodeClaim)