diff --git a/internal/metrics/aggregator.go b/internal/metrics/aggregator.go
index 78cfc94..d8a22b9 100644
--- a/internal/metrics/aggregator.go
+++ b/internal/metrics/aggregator.go
@@ -348,9 +348,14 @@ func (a *Aggregator) calculateCgroupMetrics(
 		// Calculate CPU cores used from delta
 		usedCores := 0.0
 		if prev, ok := a.prevCgroupCPU[containerName]; ok && elapsed > 0 {
-			deltaTicks := totalTicks - prev
-			// Convert ticks to cores: deltaTicks / (elapsed_seconds * CLK_TCK)
-			usedCores = float64(deltaTicks) / (elapsed * float64(proc.DefaultClockTicks))
+			// Guard against underflow: if processes exited and new ones started,
+			// totalTicks could be less than prev. In that case, skip this sample.
+			if totalTicks >= prev {
+				deltaTicks := totalTicks - prev
+				// Convert ticks to cores: deltaTicks / (elapsed_seconds * CLK_TCK)
+				usedCores = float64(deltaTicks) / (elapsed * float64(proc.DefaultClockTicks))
+			}
+			// If totalTicks < prev, usedCores stays 0 for this sample
 		}
 		a.prevCgroupCPU[containerName] = totalTicks