Image Builder Golden AMI always requires updates

When building an AMI from Ubuntu 20.04, it does not matter how many times I run 'apt-get -y upgrade' in a component or Amazon's own linux-update (UpdateOS action), whenever I create an EC2 instance from this image and SSH into it there are always updates that need to be installed. I.e. the result of 'apt list --upgradable' always returns updates. I would expect 0 updates to be required directly after building a fresh AMI and launching an instance from it. What could I be doing wrong? Any advice much appreciated.