diff --git a/internal/reconstitution/api.go b/internal/reconstitution/api.go
index 5f7d29a1..571fd734 100644
--- a/internal/reconstitution/api.go
+++ b/internal/reconstitution/api.go
@@ -22,8 +22,13 @@ type Resource struct {
 	Ref *ResourceRef
 
 	Manifest          string
-	Object            *unstructured.Unstructured
 	ReconcileInterval time.Duration
+	object            *unstructured.Unstructured
+}
+
+func (r *Resource) Object() *unstructured.Unstructured {
+	// don't allow callers to mutate the original
+	return r.object.DeepCopy()
 }
 
 // ResourceRef refers to a specific synthesized resource.
diff --git a/internal/reconstitution/cache.go b/internal/reconstitution/cache.go
index 38d8da4f..faf1b619 100644
--- a/internal/reconstitution/cache.go
+++ b/internal/reconstitution/cache.go
@@ -139,7 +139,7 @@ func (c *cache) buildResource(ctx context.Context, comp types.NamespacedName, sl
 			Kind:        parsed.GetKind(),
 		},
 		Manifest: manifest,
-		Object:   parsed,
+		object:   parsed,
 	}
 	if resource.ReconcileInterval != nil {
 		res.ReconcileInterval = resource.ReconcileInterval.Duration
diff --git a/internal/reconstitution/cache_test.go b/internal/reconstitution/cache_test.go
index 4a500717..cfc1a578 100644
--- a/internal/reconstitution/cache_test.go
+++ b/internal/reconstitution/cache_test.go
@@ -44,8 +44,8 @@ func TestCacheBasics(t *testing.T) {
 		resource, exists := c.Get(ctx, &expectedReqs[0].ResourceRef, synth.ObservedGeneration)
 		require.True(t, exists)
 		assert.NotEmpty(t, resource.Manifest)
-		assert.Equal(t, "ConfigMap", resource.Object.GetKind())
-		assert.Equal(t, "slice-0-resource-0", resource.Object.GetName())
+		assert.Equal(t, "ConfigMap", resource.Object().GetKind())
+		assert.Equal(t, "slice-0-resource-0", resource.Object().GetName())
 
 		// negative
 		_, exists = c.Get(ctx, &expectedReqs[0].ResourceRef, 123)
@@ -106,8 +106,8 @@ func TestCacheSecret(t *testing.T) {
 	resource, exists := c.Get(ctx, &expectedReqs[0].ResourceRef, synth.ObservedGeneration)
 	require.True(t, exists)
 	assert.NotEmpty(t, resource.Manifest)
-	assert.Equal(t, "ConfigMap", resource.Object.GetKind())
-	assert.Equal(t, "slice-0-resource-0", resource.Object.GetName())
+	assert.Equal(t, "ConfigMap", resource.Object().GetKind())
+	assert.Equal(t, "slice-0-resource-0", resource.Object().GetName())
 }
 
 func TestCacheInvalidManifest(t *testing.T) {