diff --git a/apis/bigquerydatatransfer/v1alpha1/config_types.go b/apis/bigquerydatatransfer/v1alpha1/config_types.go
index 96e44e8e51..4fa5a74b44 100644
--- a/apis/bigquerydatatransfer/v1alpha1/config_types.go
+++ b/apis/bigquerydatatransfer/v1alpha1/config_types.go
@@ -83,6 +83,7 @@ type BigQueryDataTransferConfigSpec struct {
 	Parent `json:",inline"`
 
 	// The BigQueryDataTransferConfig name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Data transfer schedule.
diff --git a/apis/bigquerydatatransfer/v1beta1/transferconfig_types.go b/apis/bigquerydatatransfer/v1beta1/transferconfig_types.go
index 5286345be2..1b84e11bd7 100644
--- a/apis/bigquerydatatransfer/v1beta1/transferconfig_types.go
+++ b/apis/bigquerydatatransfer/v1beta1/transferconfig_types.go
@@ -109,6 +109,7 @@ type BigQueryDataTransferConfigSpec struct {
 	Parent `json:",inline"`
 
 	// The BigQueryDataTransferConfig name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Data transfer schedule.
diff --git a/apis/certificatemanager/v1alpha1/dnsauthorization_types.go b/apis/certificatemanager/v1alpha1/dnsauthorization_types.go
index 058bc3e5d3..d6076f6950 100644
--- a/apis/certificatemanager/v1alpha1/dnsauthorization_types.go
+++ b/apis/certificatemanager/v1alpha1/dnsauthorization_types.go
@@ -41,6 +41,7 @@ type CertificateManagerDNSAuthorizationSpec struct {
 	ProjectRef refs.ProjectRef `json:"projectRef"`
 
 	/* Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	// +optional
 	ResourceID *string `json:"resourceID,omitempty"`
 }
diff --git a/apis/certificatemanager/v1beta1/dnsauthorization_types.go b/apis/certificatemanager/v1beta1/dnsauthorization_types.go
index 82e3897c61..051aa4fbd8 100644
--- a/apis/certificatemanager/v1beta1/dnsauthorization_types.go
+++ b/apis/certificatemanager/v1beta1/dnsauthorization_types.go
@@ -45,6 +45,7 @@ type CertificateManagerDNSAuthorizationSpec struct {
 	Location string `json:"location"`
 
 	/* Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	// +optional
 	ResourceID *string `json:"resourceID,omitempty"`
 }
diff --git a/apis/compute/v1beta1/targettcpproxy_types.go b/apis/compute/v1beta1/targettcpproxy_types.go
index 93467358ae..3c8d7ef166 100644
--- a/apis/compute/v1beta1/targettcpproxy_types.go
+++ b/apis/compute/v1beta1/targettcpproxy_types.go
@@ -54,6 +54,7 @@ type ComputeTargetTCPProxySpec struct {
 	ProxyHeader *string `json:"proxyHeader,omitempty"`
 
 	// The ComputeTargetTCPProxy name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 }
 
diff --git a/apis/containerattached/v1beta1/cluster_types.go b/apis/containerattached/v1beta1/cluster_types.go
index 4cc336ef19..e7fa877d82 100644
--- a/apis/containerattached/v1beta1/cluster_types.go
+++ b/apis/containerattached/v1beta1/cluster_types.go
@@ -30,6 +30,7 @@ type ContainerAttachedClusterSpec struct {
 
 	// Optional.
 	// The ContainerAttachedCluster name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Location field is immutable"
diff --git a/apis/discoveryengine/v1alpha1/discoveryenginedatastore_types.go b/apis/discoveryengine/v1alpha1/discoveryenginedatastore_types.go
index ff834c3184..e3d1747baf 100644
--- a/apis/discoveryengine/v1alpha1/discoveryenginedatastore_types.go
+++ b/apis/discoveryengine/v1alpha1/discoveryenginedatastore_types.go
@@ -26,6 +26,7 @@ var DiscoveryEngineDataStoreGVK = GroupVersion.WithKind("DiscoveryEngineDataStor
 // +kcc:proto=google.cloud.discoveryengine.v1.DataStore
 type DiscoveryEngineDataStoreSpec struct {
 	// The DiscoveryEngineDataStore name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Required. The data store display name.
diff --git a/apis/kms/v1alpha1/keyhandle_types.go b/apis/kms/v1alpha1/keyhandle_types.go
index ddd165e677..9346bc0a8b 100644
--- a/apis/kms/v1alpha1/keyhandle_types.go
+++ b/apis/kms/v1alpha1/keyhandle_types.go
@@ -30,6 +30,7 @@ type KMSKeyHandleSpec struct {
 	// The KMS Key Handle ID used for resource creation or acquisition.
 	// For creation: If specified, this value is used as the key handle ID. If not provided, a UUID will be generated and assigned as the key handle ID.
 	// For acquisition: This field must be provided to identify the key handle resource to acquire.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Project hosting KMSKeyHandle
diff --git a/apis/kms/v1beta1/keyhandle_types.go b/apis/kms/v1beta1/keyhandle_types.go
index 80dd800dee..2ebf9dd180 100644
--- a/apis/kms/v1beta1/keyhandle_types.go
+++ b/apis/kms/v1beta1/keyhandle_types.go
@@ -30,6 +30,7 @@ type KMSKeyHandleSpec struct {
 	// The KMS Key Handle ID used for resource creation or acquisition.
 	// For creation: If specified, this value is used as the key handle ID. If not provided, a UUID will be generated and assigned as the key handle ID.
 	// For acquisition: This field must be provided to identify the key handle resource to acquire.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Project hosting KMSKeyHandle
diff --git a/apis/privilegedaccessmanager/v1alpha1/entitlement_types.go b/apis/privilegedaccessmanager/v1alpha1/entitlement_types.go
index 6013c22dfc..9c1399c7dc 100644
--- a/apis/privilegedaccessmanager/v1alpha1/entitlement_types.go
+++ b/apis/privilegedaccessmanager/v1alpha1/entitlement_types.go
@@ -50,6 +50,7 @@ type PrivilegedAccessManagerEntitlementSpec struct {
 
 	// The PrivilegedAccessManagerEntitlement name. If not given, the
 	// 'metadata.name' will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	// +optional
 	ResourceID *string `json:"resourceID,omitempty"`
 
diff --git a/apis/privilegedaccessmanager/v1beta1/privilegedaccessmanagerentitlement_types.go b/apis/privilegedaccessmanager/v1beta1/privilegedaccessmanagerentitlement_types.go
index e67fcebc08..0f0c6ed834 100644
--- a/apis/privilegedaccessmanager/v1beta1/privilegedaccessmanagerentitlement_types.go
+++ b/apis/privilegedaccessmanager/v1beta1/privilegedaccessmanagerentitlement_types.go
@@ -51,6 +51,7 @@ type PrivilegedAccessManagerEntitlementSpec struct {
 	// Immutable.
 	// The PrivilegedAccessManagerEntitlement name. If not given, the
 	// 'metadata.name' will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	// +optional
 	ResourceID *string `json:"resourceID,omitempty"`
 
diff --git a/apis/secretmanager/v1beta1/secret_types.go b/apis/secretmanager/v1beta1/secret_types.go
index eaf1c3fc93..4dc4a945db 100644
--- a/apis/secretmanager/v1beta1/secret_types.go
+++ b/apis/secretmanager/v1beta1/secret_types.go
@@ -29,6 +29,7 @@ var SecretManagerSecretGVK = GroupVersion.WithKind("SecretManagerSecret")
 // +kcc:proto=google.cloud.secretmanager.v1.Secret
 type SecretManagerSecretSpec struct {
 	// The SecretManagerSecret name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Immutable. The replication policy of the secret data attached to
diff --git a/apis/securesourcemanager/v1alpha1/repository_types.go b/apis/securesourcemanager/v1alpha1/repository_types.go
index da1e6859a8..c2225c36b6 100644
--- a/apis/securesourcemanager/v1alpha1/repository_types.go
+++ b/apis/securesourcemanager/v1alpha1/repository_types.go
@@ -36,6 +36,7 @@ type SecureSourceManagerRepositorySpec struct {
 	Location string `json:"location"`
 
 	// The SecureSourceManagerRepository name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// The name of the instance in which the repository is hosted, formatted as
diff --git a/apis/spanner/v1beta1/instance_types.go b/apis/spanner/v1beta1/instance_types.go
index 135ba30a46..84a4d5f9f9 100644
--- a/apis/spanner/v1beta1/instance_types.go
+++ b/apis/spanner/v1beta1/instance_types.go
@@ -46,6 +46,7 @@ type SpannerInstanceSpec struct {
 	ProcessingUnits *int32 `json:"processingUnits,omitempty"`
 
 	// The SpannerInstance name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 }
 
diff --git a/apis/workstations/v1alpha1/cluster_types.go b/apis/workstations/v1alpha1/cluster_types.go
index 18813affed..47b67346cb 100644
--- a/apis/workstations/v1alpha1/cluster_types.go
+++ b/apis/workstations/v1alpha1/cluster_types.go
@@ -37,6 +37,7 @@ type WorkstationClusterSpec struct {
 	Location string `json:"location,omitempty"`
 
 	// The WorkstationCluster name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Human-readable name for this workstation cluster.
diff --git a/apis/workstations/v1alpha1/config_types.go b/apis/workstations/v1alpha1/config_types.go
index c3ab8df420..7783423b81 100644
--- a/apis/workstations/v1alpha1/config_types.go
+++ b/apis/workstations/v1alpha1/config_types.go
@@ -275,6 +275,7 @@ type WorkstationConfigSpec struct {
 	Parent *WorkstationClusterRef `json:"parentRef"`
 
 	// The WorkstationConfig name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Human-readable name for this workstation configuration.
diff --git a/apis/workstations/v1alpha1/workstation_types.go b/apis/workstations/v1alpha1/workstation_types.go
index 0601371243..5a4e289cee 100644
--- a/apis/workstations/v1alpha1/workstation_types.go
+++ b/apis/workstations/v1alpha1/workstation_types.go
@@ -28,6 +28,7 @@ type WorkstationSpec struct {
 	Parent *WorkstationConfigRef `json:"parentRef"`
 
 	// The Workstation name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Human-readable name for this workstation.
diff --git a/apis/workstations/v1beta1/cluster_types.go b/apis/workstations/v1beta1/cluster_types.go
index acd2f85560..a0dd6ddeed 100644
--- a/apis/workstations/v1beta1/cluster_types.go
+++ b/apis/workstations/v1beta1/cluster_types.go
@@ -37,6 +37,7 @@ type WorkstationClusterSpec struct {
 	Location string `json:"location,omitempty"`
 
 	// The WorkstationCluster name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Human-readable name for this workstation cluster.
diff --git a/apis/workstations/v1beta1/config_types.go b/apis/workstations/v1beta1/config_types.go
index ec65fecea8..22128f9977 100644
--- a/apis/workstations/v1beta1/config_types.go
+++ b/apis/workstations/v1beta1/config_types.go
@@ -275,6 +275,7 @@ type WorkstationConfigSpec struct {
 	Parent *WorkstationClusterRef `json:"parentRef"`
 
 	// The WorkstationConfig name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Human-readable name for this workstation configuration.
diff --git a/apis/workstations/v1beta1/workstation_types.go b/apis/workstations/v1beta1/workstation_types.go
index 1df85c01d2..97541122ff 100644
--- a/apis/workstations/v1beta1/workstation_types.go
+++ b/apis/workstations/v1beta1/workstation_types.go
@@ -28,6 +28,7 @@ type WorkstationSpec struct {
 	Parent *WorkstationConfigRef `json:"parentRef"`
 
 	// The Workstation name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Human-readable name for this workstation.
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_bigquerydatatransferconfigs.bigquerydatatransfer.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_bigquerydatatransferconfigs.bigquerydatatransfer.cnrm.cloud.google.com.yaml
index 2cbad467a2..fe62114671 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_bigquerydatatransferconfigs.bigquerydatatransfer.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_bigquerydatatransferconfigs.bigquerydatatransfer.cnrm.cloud.google.com.yaml
@@ -233,7 +233,8 @@ spec:
                 type: object
               resourceID:
                 description: The BigQueryDataTransferConfig name. If not given, the
-                  metadata.name will be used.
+                  metadata.name will be used. Cannot be changed after create, except
+                  for updating from empty string to the actual resource ID.
                 type: string
               schedule:
                 description: |-
@@ -619,7 +620,8 @@ spec:
                 type: object
               resourceID:
                 description: The BigQueryDataTransferConfig name. If not given, the
-                  metadata.name will be used.
+                  metadata.name will be used. Cannot be changed after create, except
+                  for updating from empty string to the actual resource ID.
                 type: string
               schedule:
                 description: |-
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_certificatemanagerdnsauthorizations.certificatemanager.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_certificatemanagerdnsauthorizations.certificatemanager.cnrm.cloud.google.com.yaml
index 86681936a3..7bf8dcb8f6 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_certificatemanagerdnsauthorizations.certificatemanager.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_certificatemanagerdnsauthorizations.certificatemanager.cnrm.cloud.google.com.yaml
@@ -109,7 +109,8 @@ spec:
               resourceID:
                 description: Optional. The name of the resource. Used for creation
                   and acquisition. When unset, the value of `metadata.name` is used
-                  as the default.
+                  as the default. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
             required:
             - domain
@@ -269,7 +270,8 @@ spec:
               resourceID:
                 description: Optional. The name of the resource. Used for creation
                   and acquisition. When unset, the value of `metadata.name` is used
-                  as the default.
+                  as the default. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
             required:
             - domain
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_computetargettcpproxies.compute.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_computetargettcpproxies.compute.cnrm.cloud.google.com.yaml
index d6382d0376..d47d0574ce 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_computetargettcpproxies.compute.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_computetargettcpproxies.compute.cnrm.cloud.google.com.yaml
@@ -117,7 +117,8 @@ spec:
                 type: string
               resourceID:
                 description: The ComputeTargetTCPProxy name. If not given, the metadata.name
-                  will be used.
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
             required:
             - backendServiceRef
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_containerattachedclusters.containerattached.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_containerattachedclusters.containerattached.cnrm.cloud.google.com.yaml
index 4f03b72b64..ff56fef34d 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_containerattachedclusters.containerattached.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_containerattachedclusters.containerattached.cnrm.cloud.google.com.yaml
@@ -271,7 +271,8 @@ spec:
                 type: object
               resourceID:
                 description: Optional. The ContainerAttachedCluster name. If not given,
-                  the metadata.name will be used.
+                  the metadata.name will be used. Cannot be changed after create,
+                  except for updating from empty string to the actual resource ID.
                 type: string
             required:
             - distribution
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_discoveryenginedatastores.discoveryengine.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_discoveryenginedatastores.discoveryengine.cnrm.cloud.google.com.yaml
index d2d981fec4..31feadaadc 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_discoveryenginedatastores.discoveryengine.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_discoveryenginedatastores.discoveryengine.cnrm.cloud.google.com.yaml
@@ -122,7 +122,8 @@ spec:
                 type: object
               resourceID:
                 description: The DiscoveryEngineDataStore name. If not given, the
-                  metadata.name will be used.
+                  metadata.name will be used. Cannot be changed after create, except
+                  for updating from empty string to the actual resource ID.
                 type: string
               solutionTypes:
                 description: |-
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_kmskeyhandles.kms.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_kmskeyhandles.kms.cnrm.cloud.google.com.yaml
index 404ae3f702..9bcc7f6c6c 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_kmskeyhandles.kms.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_kmskeyhandles.kms.cnrm.cloud.google.com.yaml
@@ -100,7 +100,9 @@ spec:
                   acquisition. For creation: If specified, this value is used as the
                   key handle ID. If not provided, a UUID will be generated and assigned
                   as the key handle ID. For acquisition: This field must be provided
-                  to identify the key handle resource to acquire.'
+                  to identify the key handle resource to acquire. Cannot be changed
+                  after create, except for updating from empty string to the actual
+                  resource ID.'
                 type: string
               resourceTypeSelector:
                 description: Indicates the resource type that the resulting [CryptoKey][]
@@ -240,7 +242,9 @@ spec:
                   acquisition. For creation: If specified, this value is used as the
                   key handle ID. If not provided, a UUID will be generated and assigned
                   as the key handle ID. For acquisition: This field must be provided
-                  to identify the key handle resource to acquire.'
+                  to identify the key handle resource to acquire. Cannot be changed
+                  after create, except for updating from empty string to the actual
+                  resource ID.'
                 type: string
               resourceTypeSelector:
                 description: Indicates the resource type that the resulting [CryptoKey][]
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_privilegedaccessmanagerentitlements.privilegedaccessmanager.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_privilegedaccessmanagerentitlements.privilegedaccessmanager.cnrm.cloud.google.com.yaml
index a51b2c38bf..8ec36b2411 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_privilegedaccessmanagerentitlements.privilegedaccessmanager.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_privilegedaccessmanagerentitlements.privilegedaccessmanager.cnrm.cloud.google.com.yaml
@@ -304,7 +304,8 @@ spec:
                 type: object
               resourceID:
                 description: The PrivilegedAccessManagerEntitlement name. If not given,
-                  the 'metadata.name' will be used.
+                  the 'metadata.name' will be used. Cannot be changed after create,
+                  except for updating from empty string to the actual resource ID.
                 type: string
             required:
             - eligibleUsers
@@ -668,7 +669,9 @@ spec:
                 type: object
               resourceID:
                 description: Immutable. The PrivilegedAccessManagerEntitlement name.
-                  If not given, the 'metadata.name' will be used.
+                  If not given, the 'metadata.name' will be used. Cannot be changed
+                  after create, except for updating from empty string to the actual
+                  resource ID.
                 type: string
             required:
             - eligibleUsers
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_secretmanagersecrets.secretmanager.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_secretmanagersecrets.secretmanager.cnrm.cloud.google.com.yaml
index 0390b61062..c951e79f96 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_secretmanagersecrets.secretmanager.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_secretmanagersecrets.secretmanager.cnrm.cloud.google.com.yaml
@@ -240,7 +240,8 @@ spec:
                 type: object
               resourceID:
                 description: The SecretManagerSecret name. If not given, the metadata.name
-                  will be used.
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
               rotation:
                 description: Optional. Rotation policy attached to the [Secret][google.cloud.secretmanager.v1.Secret].
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_securesourcemanagerrepositories.securesourcemanager.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_securesourcemanagerrepositories.securesourcemanager.cnrm.cloud.google.com.yaml
index be6ccb19e7..7370e6d5b6 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_securesourcemanagerrepositories.securesourcemanager.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_securesourcemanagerrepositories.securesourcemanager.cnrm.cloud.google.com.yaml
@@ -269,7 +269,8 @@ spec:
                 type: object
               resourceID:
                 description: The SecureSourceManagerRepository name. If not given,
-                  the metadata.name will be used.
+                  the metadata.name will be used. Cannot be changed after create,
+                  except for updating from empty string to the actual resource ID.
                 type: string
             required:
             - instanceRef
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_spannerinstances.spanner.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_spannerinstances.spanner.cnrm.cloud.google.com.yaml
index 7107942e95..5e506239d9 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_spannerinstances.spanner.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_spannerinstances.spanner.cnrm.cloud.google.com.yaml
@@ -84,7 +84,8 @@ spec:
                 type: integer
               resourceID:
                 description: The SpannerInstance name. If not given, the metadata.name
-                  will be used.
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
             required:
             - config
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationclusters.workstations.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationclusters.workstations.cnrm.cloud.google.com.yaml
index 6872239ffc..017c95217a 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationclusters.workstations.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationclusters.workstations.cnrm.cloud.google.com.yaml
@@ -203,7 +203,8 @@ spec:
                   rule: self == oldSelf
               resourceID:
                 description: The WorkstationCluster name. If not given, the metadata.name
-                  will be used.
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
               subnetworkRef:
                 description: Immutable. Reference to the Compute Engine subnetwork
@@ -546,7 +547,8 @@ spec:
                   rule: self == oldSelf
               resourceID:
                 description: The WorkstationCluster name. If not given, the metadata.name
-                  will be used.
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
               subnetworkRef:
                 description: Immutable. Reference to the Compute Engine subnetwork
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationconfigs.workstations.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationconfigs.workstations.cnrm.cloud.google.com.yaml
index 24158c3108..50aecec4b0 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationconfigs.workstations.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationconfigs.workstations.cnrm.cloud.google.com.yaml
@@ -507,7 +507,8 @@ spec:
                 type: array
               resourceID:
                 description: The WorkstationConfig name. If not given, the metadata.name
-                  will be used.
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
               runningTimeout:
                 description: |-
@@ -1134,7 +1135,8 @@ spec:
                 type: array
               resourceID:
                 description: The WorkstationConfig name. If not given, the metadata.name
-                  will be used.
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
               runningTimeout:
                 description: |-
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstations.workstations.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstations.workstations.cnrm.cloud.google.com.yaml
index c680d7c072..e23c2be9ae 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstations.workstations.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstations.workstations.cnrm.cloud.google.com.yaml
@@ -119,7 +119,8 @@ spec:
                 type: object
               resourceID:
                 description: The Workstation name. If not given, the metadata.name
-                  will be used.
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
             required:
             - parentRef
@@ -308,7 +309,8 @@ spec:
                 type: object
               resourceID:
                 description: The Workstation name. If not given, the metadata.name
-                  will be used.
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
             required:
             - parentRef
diff --git a/dev/tools/controllerbuilder/template/apis/types.go b/dev/tools/controllerbuilder/template/apis/types.go
index 97d083c018..26d017d11e 100644
--- a/dev/tools/controllerbuilder/template/apis/types.go
+++ b/dev/tools/controllerbuilder/template/apis/types.go
@@ -38,6 +38,7 @@ var {{ .Kind }}GVK = GroupVersion.WithKind("{{ .Kind }}")
 {{- end }}
 type {{ .Kind }}Spec struct {
 	// The {{ .Kind }} name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string ` + "`" + `json:"resourceID,omitempty"` + "`" + `
 }
 
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/bigquerydatatransfer/bigquerydatatransferconfig.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/bigquerydatatransfer/bigquerydatatransferconfig.md
index b9a298c03d..8cc7474b5b 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/bigquerydatatransfer/bigquerydatatransferconfig.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/bigquerydatatransfer/bigquerydatatransferconfig.md
@@ -387,7 +387,7 @@ serviceAccountRef:
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}The BigQueryDataTransferConfig name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The BigQueryDataTransferConfig name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
     <tr>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/certificatemanager/certificatemanagerdnsauthorization.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/certificatemanager/certificatemanagerdnsauthorization.md
index 2b29ebe952..5afbf2b9fa 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/certificatemanager/certificatemanagerdnsauthorization.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/certificatemanager/certificatemanagerdnsauthorization.md
@@ -168,7 +168,7 @@ resourceID: string
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default.{% endverbatim %}</p>
+            <p>{% verbatim %}Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
 </tbody>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/compute/computetargettcpproxy.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/compute/computetargettcpproxy.md
index ab23080999..d01c07c9fa 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/compute/computetargettcpproxy.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/compute/computetargettcpproxy.md
@@ -182,7 +182,7 @@ resourceID: string
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}The ComputeTargetTCPProxy name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The ComputeTargetTCPProxy name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
 </tbody>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/containerattached/containerattachedcluster.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/containerattached/containerattachedcluster.md
index 3cea3273b0..c14594b33e 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/containerattached/containerattachedcluster.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/containerattached/containerattachedcluster.md
@@ -512,7 +512,7 @@ while clusters with private issuers need to provide both 'issuerUrl' and 'jwks'.
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Optional. The ContainerAttachedCluster name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}Optional. The ContainerAttachedCluster name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
 </tbody>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/kms/kmskeyhandle.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/kms/kmskeyhandle.md
index fe15c216ed..fbda7ed506 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/kms/kmskeyhandle.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/kms/kmskeyhandle.md
@@ -147,7 +147,7 @@ resourceTypeSelector: string
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}The KMS Key Handle ID used for resource creation or acquisition. For creation: If specified, this value is used as the key handle ID. If not provided, a UUID will be generated and assigned as the key handle ID. For acquisition: This field must be provided to identify the key handle resource to acquire.{% endverbatim %}</p>
+            <p>{% verbatim %}The KMS Key Handle ID used for resource creation or acquisition. For creation: If specified, this value is used as the key handle ID. If not provided, a UUID will be generated and assigned as the key handle ID. For acquisition: This field must be provided to identify the key handle resource to acquire. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
     <tr>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/privilegedaccessmanager/privilegedaccessmanagerentitlement.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/privilegedaccessmanager/privilegedaccessmanagerentitlement.md
index 9a73baa71c..9833be7cc6 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/privilegedaccessmanager/privilegedaccessmanagerentitlement.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/privilegedaccessmanager/privilegedaccessmanagerentitlement.md
@@ -562,7 +562,7 @@ https://cloud.google.com/iam/docs/conditions-overview#attributes.{% endverbatim
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Immutable. The PrivilegedAccessManagerEntitlement name. If not given, the 'metadata.name' will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}Immutable. The PrivilegedAccessManagerEntitlement name. If not given, the 'metadata.name' will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
 </tbody>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/secretmanager/secretmanagersecret.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/secretmanager/secretmanagersecret.md
index 2cee06f808..16fa71d199 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/secretmanager/secretmanagersecret.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/secretmanager/secretmanagersecret.md
@@ -395,7 +395,7 @@ versionAliases:
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}The SecretManagerSecret name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The SecretManagerSecret name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
     <tr>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/spanner/spannerinstance.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/spanner/spannerinstance.md
index 48cd9330bb..703c07f20c 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/spanner/spannerinstance.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/spanner/spannerinstance.md
@@ -159,7 +159,7 @@ resourceID: string
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}The SpannerInstance name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The SpannerInstance name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
 </tbody>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstation.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstation.md
index 9eac4309a1..bc375f68e6 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstation.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstation.md
@@ -219,7 +219,7 @@ resourceID: string
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}The Workstation name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The Workstation name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
 </tbody>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationcluster.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationcluster.md
index 423077e179..ffa548beaa 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationcluster.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationcluster.md
@@ -376,7 +376,7 @@ subnetworkRef:
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}The WorkstationCluster name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The WorkstationCluster name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
     <tr>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationconfig.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationconfig.md
index c5baeed10b..230574ff09 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationconfig.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationconfig.md
@@ -955,7 +955,7 @@ runningTimeout: string
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}The WorkstationConfig name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The WorkstationConfig name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
     <tr>