diff --git a/app/jobs/titre_identite_watermark_job.rb b/app/jobs/titre_identite_watermark_job.rb
index 6364b2fd4..580dc204d 100644
--- a/app/jobs/titre_identite_watermark_job.rb
+++ b/app/jobs/titre_identite_watermark_job.rb
@@ -15,8 +15,8 @@ class TitreIdentiteWatermarkJob < ApplicationJob
   WATERMARK = URI.parse(WATERMARK_FILE).is_a?(URI::HTTP) ? WATERMARK_FILE : Rails.root.join("app/assets/images/#{WATERMARK_FILE}")
 
   def perform(blob)
-    if blob.virus_scanner.pending? then raise FileNotScannedYetError end
-    if blob.watermark_done? then return end
+    return if blob.watermark_done?
+    raise FileNotScannedYetError if blob.virus_scanner.pending?
 
     blob.open do |file|
       watermark = resize_watermark(file)
@@ -24,12 +24,8 @@ class TitreIdentiteWatermarkJob < ApplicationJob
       if watermark.present?
         processed = watermark_image(file, watermark)
 
-        blob.metadata[:watermark] = true
         blob.upload(processed)
-        blob.save
-      else
-        blob.metadata[:watermark_invalid] = true
-        blob.save
+        blob.touch(:watermarked_at)
       end
     end
   end
diff --git a/app/models/concerns/blob_titre_identite_watermark_concern.rb b/app/models/concerns/blob_titre_identite_watermark_concern.rb
index 598a23d05..152c512f9 100644
--- a/app/models/concerns/blob_titre_identite_watermark_concern.rb
+++ b/app/models/concerns/blob_titre_identite_watermark_concern.rb
@@ -4,11 +4,11 @@ module BlobTitreIdentiteWatermarkConcern
   end
 
   def watermark_done?
-    metadata[:watermark]
+    watermarked_at.present?
   end
 
   def watermark_later
-    if watermark_required?
+    if watermark_pending?
       TitreIdentiteWatermarkJob.perform_later(self)
     end
   end
@@ -16,6 +16,6 @@ module BlobTitreIdentiteWatermarkConcern
   private
 
   def watermark_required?
-    attachments.any? { |attachment| attachment.record.class.name == 'Champs::TitreIdentiteChamp' }
+    attachments.any? { _1.record.class == Champs::TitreIdentiteChamp }
   end
 end
diff --git a/db/migrate/20221222163907_add_watermarked_at_active_storage_blobs.rb b/db/migrate/20221222163907_add_watermarked_at_active_storage_blobs.rb
new file mode 100644
index 000000000..2179bfe04
--- /dev/null
+++ b/db/migrate/20221222163907_add_watermarked_at_active_storage_blobs.rb
@@ -0,0 +1,5 @@
+class AddWatermarkedAtActiveStorageBlobs < ActiveRecord::Migration[6.1]
+  def change
+    add_column :active_storage_blobs, :watermarked_at, :datetime
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 313080e07..037c0a890 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -47,6 +47,7 @@ ActiveRecord::Schema.define(version: 2022_12_13_084442) do
     t.integer "lock_version"
     t.text "metadata"
     t.string "service_name", null: false
+    t.datetime "watermarked_at"
     t.index ["key"], name: "index_active_storage_blobs_on_key", unique: true
   end
 
diff --git a/lib/tasks/deployment/20221222164435_backfill_watermarked_blobs.rake b/lib/tasks/deployment/20221222164435_backfill_watermarked_blobs.rake
new file mode 100644
index 000000000..3e0bda1d7
--- /dev/null
+++ b/lib/tasks/deployment/20221222164435_backfill_watermarked_blobs.rake
@@ -0,0 +1,16 @@
+namespace :after_party do
+  desc 'Deployment task: backfill_watermarked_blobs'
+  task backfill_watermarked_blobs: :environment do
+    puts "Running deploy task 'backfill_watermarked_blobs'"
+
+    ActiveStorage::Blob.where("metadata like '%\"watermark\":true%'")
+      .where(watermarked_at: nil)
+      .in_batches
+      .update_all('watermarked_at = created_at')
+
+    # Update task as completed.  If you remove the line below, the task will
+    # run with every deploy (or every time you call after_party:run).
+    AfterParty::TaskRecord
+      .create version: AfterParty::TaskRecorder.new(__FILE__).timestamp
+  end
+end
diff --git a/spec/components/attachment/edit_component_spec.rb b/spec/components/attachment/edit_component_spec.rb
index 2c1c48264..bcae3b6ec 100644
--- a/spec/components/attachment/edit_component_spec.rb
+++ b/spec/components/attachment/edit_component_spec.rb
@@ -88,7 +88,7 @@ RSpec.describe Attachment::EditComponent, type: :component do
 
     context 'when watermarking is done' do
       before do
-        attachment.metadata['watermark'] = true
+        attachment.blob.touch(:watermarked_at)
       end
 
       it 'renders a complete downlaod interface with details to download the file' do
@@ -115,7 +115,7 @@ RSpec.describe Attachment::EditComponent, type: :component do
 
     context 'when watermarking is done' do
       before do
-        attachment.metadata['watermark'] = true
+        attachment.blob.touch(:watermarked_at)
       end
 
       it 'renders a simple link to view file' do
diff --git a/spec/components/attachment/pending_poll_component_spec.rb b/spec/components/attachment/pending_poll_component_spec.rb
index 4b8e93df9..1bd9f9f5f 100644
--- a/spec/components/attachment/pending_poll_component_spec.rb
+++ b/spec/components/attachment/pending_poll_component_spec.rb
@@ -39,7 +39,7 @@ RSpec.describe Attachment::PendingPollComponent, type: :component do
 
   context "when waterkmark is done" do
     before do
-      attachment.blob[:metadata] = { watermark: true }
+      attachment.blob.touch(:watermarked_at)
     end
 
     it "does not render" do