Dynamically recommending changes to an association between an operating system image and an update group includes monitoring a configuration of a deployed copy of a first master operating system (OS) image; detecting a modification in the configuration of the deployed copy; determining that the configuration of the deployed copy with the modification more closely matches a configuration of a second master OS image than a configuration of the first master OS image; in response to determining that the configuration of the deployed copy with the modification more closely matches the configuration of the second master OS image, generating an association recommendation that recommends associating the deployed copy with a second update group of the second master OS image; and associating the deployed copy with the second update group of the second master OS image instead of the first update group of the first master OS image.