diff --git a/common/BUILD.bazel b/common/BUILD.bazel
index 88fd9d742..b3276abd4 100644
--- a/common/BUILD.bazel
+++ b/common/BUILD.bazel
@@ -2,7 +2,7 @@ load("@aspect_bazel_lib//lib:tar.bzl", "tar")
 load("@rules_distroless//distroless:defs.bzl", "cacerts", "group", "home", "locale", "os_release", "passwd")
 load("//:distro.bzl", "ALL_ARCHITECTURES", "ALL_DISTROS", "VERSIONS")
 load("//private/util:deb.bzl", "deb")
-load(":variables.bzl", "MTIME", "NOBODY", "NONROOT", "OS_RELEASE", "ROOT", "quote")
+load(":variables.bzl", "NOBODY", "NONROOT", "OS_RELEASE", "ROOT", "quote")
 
 package(default_visibility = ["//visibility:public"])
 
@@ -30,7 +30,7 @@ tar(
         "gnutar",
     ],
     compress = "gzip",
-    mtree = ["./tmp gname=root uname=root time=1501783453.0 mode=1777 gid=0 uid=0 type=dir"],
+    mtree = ["./tmp gname=root uname=root time=0.0 mode=1777 gid=0 uid=0 type=dir"],
 )
 
 [
@@ -43,7 +43,6 @@ tar(
             ))
             for (key, value) in OS_RELEASE.items()
         },
-        time = MTIME,
     )
     for (dist, codename, version) in VERSIONS
 ]
@@ -53,7 +52,6 @@ tar(
         name = "locale_%s_%s" % (distro, arch),
         charset = "C.utf8",
         package = deb.data(arch, distro, "libc-bin"),
-        time = MTIME,
     )
     for arch in COMMON_ARCHITECTURES
     for distro in COMMON_DISTROS
@@ -63,7 +61,6 @@ tar(
     cacerts(
         name = "cacerts_%s_%s" % (distro, arch),
         package = deb.data(arch, distro, "ca-certificates"),
-        time = MTIME,
     )
     for arch in COMMON_ARCHITECTURES
     for distro in COMMON_DISTROS
@@ -99,7 +96,6 @@ group(
             "password": "x",
         },
     ],
-    time = MTIME,
 )
 
 passwd(
diff --git a/common/variables.bzl b/common/variables.bzl
index cb1821ff0..cfea594bb 100644
--- a/common/variables.bzl
+++ b/common/variables.bzl
@@ -18,8 +18,5 @@ NOBODY = 65534
 NONROOT = 65532
 ROOT = 0
 
-# TODO: this should be 0, but for now we'll use this to minimize diff.
-MTIME = "946684800"
-
 DEBUG_MODE = ["", "_debug"]
 USERS = ["root", "nonroot"]
diff --git a/private/tools/diff.bash b/private/tools/diff.bash
index e3c283cb3..4f0121264 100755
--- a/private/tools/diff.bash
+++ b/private/tools/diff.bash
@@ -206,7 +206,7 @@ function test_image() {
 
     bazel build "$image_label"
     crane push "$(bazel cquery --output=files $image_label)" "$repo_stage"
-    if ! diffoci diff --pull=always --all-platforms --semantic "$repo_origin" "$repo_stage"; then
+    if ! diffoci diff --pull=always --all-platforms "$repo_origin" "$repo_stage"; then
         echo ""
         echo "      🔬 To reproduce: bazel run //private/tools:diff -- --only $image_label"
         echo ""
diff --git a/private/util/java_cacerts.bzl b/private/util/java_cacerts.bzl
index d88cb5496..c5495c614 100644
--- a/private/util/java_cacerts.bzl
+++ b/private/util/java_cacerts.bzl
@@ -1,7 +1,6 @@
 "java ca certificates"
 
 load("@rules_distroless//distroless:defs.bzl", "java_keystore")
-load("//common:variables.bzl", "MTIME")
 load(":extract.bzl", "tar_extract_file")
 
 def java_cacerts(name, archive):
@@ -16,5 +15,4 @@ def java_cacerts(name, archive):
         certificates = [
             ":" + name + "_extract",
         ],
-        time = MTIME,
     )