diff --git a/apis/bigquerydatatransfer/v1alpha1/config_types.go b/apis/bigquerydatatransfer/v1alpha1/config_types.go
index d17df68b5c..4fa5a74b44 100644
--- a/apis/bigquerydatatransfer/v1alpha1/config_types.go
+++ b/apis/bigquerydatatransfer/v1alpha1/config_types.go
@@ -82,9 +82,8 @@ type BigQueryDataTransferConfigSpec struct {
 
 	Parent `json:",inline"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The BigQueryDataTransferConfig name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Data transfer schedule.
diff --git a/apis/bigquerydatatransfer/v1beta1/transferconfig_types.go b/apis/bigquerydatatransfer/v1beta1/transferconfig_types.go
index 597e5126c6..1b84e11bd7 100644
--- a/apis/bigquerydatatransfer/v1beta1/transferconfig_types.go
+++ b/apis/bigquerydatatransfer/v1beta1/transferconfig_types.go
@@ -108,9 +108,8 @@ type BigQueryDataTransferConfigSpec struct {
 
 	Parent `json:",inline"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The BigQueryDataTransferConfig name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Data transfer schedule.
diff --git a/apis/certificatemanager/v1alpha1/dnsauthorization_types.go b/apis/certificatemanager/v1alpha1/dnsauthorization_types.go
index 3e393b91df..d6076f6950 100644
--- a/apis/certificatemanager/v1alpha1/dnsauthorization_types.go
+++ b/apis/certificatemanager/v1alpha1/dnsauthorization_types.go
@@ -40,8 +40,8 @@ type CertificateManagerDNSAuthorizationSpec struct {
 	// +required
 	ProjectRef refs.ProjectRef `json:"projectRef"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	/* Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
+	/* Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	// +optional
 	ResourceID *string `json:"resourceID,omitempty"`
 }
diff --git a/apis/certificatemanager/v1beta1/dnsauthorization_types.go b/apis/certificatemanager/v1beta1/dnsauthorization_types.go
index 7169c3fe6b..051aa4fbd8 100644
--- a/apis/certificatemanager/v1beta1/dnsauthorization_types.go
+++ b/apis/certificatemanager/v1beta1/dnsauthorization_types.go
@@ -44,8 +44,8 @@ type CertificateManagerDNSAuthorizationSpec struct {
 	// +optional
 	Location string `json:"location"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	/* Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
+	/* Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	// +optional
 	ResourceID *string `json:"resourceID,omitempty"`
 }
diff --git a/apis/compute/v1beta1/targettcpproxy_types.go b/apis/compute/v1beta1/targettcpproxy_types.go
index fb17ec5ece..3c8d7ef166 100644
--- a/apis/compute/v1beta1/targettcpproxy_types.go
+++ b/apis/compute/v1beta1/targettcpproxy_types.go
@@ -53,8 +53,8 @@ type ComputeTargetTCPProxySpec struct {
 	// the backend. Default value: "NONE" Possible values: ["NONE", "PROXY_V1"].
 	ProxyHeader *string `json:"proxyHeader,omitempty"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID is immutable"
-	// Immutable. The ComputeTargetTCPProxy name. If not given, the metadata.name will be used.
+	// The ComputeTargetTCPProxy name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 }
 
diff --git a/apis/containerattached/v1beta1/cluster_types.go b/apis/containerattached/v1beta1/cluster_types.go
index 0965f3da71..e7fa877d82 100644
--- a/apis/containerattached/v1beta1/cluster_types.go
+++ b/apis/containerattached/v1beta1/cluster_types.go
@@ -28,9 +28,9 @@ type ContainerAttachedClusterSpec struct {
 	/* The ID of the project in which the resource belongs.*/
 	ProjectRef *refs.ProjectRef `json:"projectRef"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable, Optional.
+	// Optional.
 	// The ContainerAttachedCluster name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Location field is immutable"
diff --git a/apis/discoveryengine/v1alpha1/discoveryenginedatastore_types.go b/apis/discoveryengine/v1alpha1/discoveryenginedatastore_types.go
index 890906bbae..e3d1747baf 100644
--- a/apis/discoveryengine/v1alpha1/discoveryenginedatastore_types.go
+++ b/apis/discoveryengine/v1alpha1/discoveryenginedatastore_types.go
@@ -25,9 +25,8 @@ var DiscoveryEngineDataStoreGVK = GroupVersion.WithKind("DiscoveryEngineDataStor
 // DiscoveryEngineDataStoreSpec defines the desired state of DiscoveryEngineDataStore
 // +kcc:proto=google.cloud.discoveryengine.v1.DataStore
 type DiscoveryEngineDataStoreSpec struct {
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The DiscoveryEngineDataStore name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Required. The data store display name.
diff --git a/apis/kms/v1alpha1/keyhandle_types.go b/apis/kms/v1alpha1/keyhandle_types.go
index 1a4816be2e..9346bc0a8b 100644
--- a/apis/kms/v1alpha1/keyhandle_types.go
+++ b/apis/kms/v1alpha1/keyhandle_types.go
@@ -27,11 +27,10 @@ var KMSKeyHandleGVK = GroupVersion.WithKind("KMSKeyHandle")
 // KMSKeyHandleSpec defines the desired state of KMSKeyHandle
 // +kcc:proto=google.cloud.kms.v1.KeyHandle
 type KMSKeyHandleSpec struct {
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The KMS Key Handle ID used for resource creation or acquisition.
 	// For creation: If specified, this value is used as the key handle ID. If not provided, a UUID will be generated and assigned as the key handle ID.
 	// For acquisition: This field must be provided to identify the key handle resource to acquire.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Project hosting KMSKeyHandle
diff --git a/apis/kms/v1beta1/keyhandle_types.go b/apis/kms/v1beta1/keyhandle_types.go
index 8384b6bd4c..2ebf9dd180 100644
--- a/apis/kms/v1beta1/keyhandle_types.go
+++ b/apis/kms/v1beta1/keyhandle_types.go
@@ -27,11 +27,10 @@ var KMSKeyHandleGVK = SchemeGroupVersion.WithKind("KMSKeyHandle")
 // KMSKeyHandleSpec defines the desired state of KMSKeyHandle
 // +kcc:proto=google.cloud.kms.v1.KeyHandle
 type KMSKeyHandleSpec struct {
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The KMS Key Handle ID used for resource creation or acquisition.
 	// For creation: If specified, this value is used as the key handle ID. If not provided, a UUID will be generated and assigned as the key handle ID.
 	// For acquisition: This field must be provided to identify the key handle resource to acquire.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Project hosting KMSKeyHandle
diff --git a/apis/privilegedaccessmanager/v1alpha1/entitlement_types.go b/apis/privilegedaccessmanager/v1alpha1/entitlement_types.go
index 2831970502..9c1399c7dc 100644
--- a/apis/privilegedaccessmanager/v1alpha1/entitlement_types.go
+++ b/apis/privilegedaccessmanager/v1alpha1/entitlement_types.go
@@ -48,10 +48,9 @@ type PrivilegedAccessManagerEntitlementSpec struct {
 	// +required
 	Location *string `json:"location"`
 
-	// Immutable.
 	// The PrivilegedAccessManagerEntitlement name. If not given, the
 	// 'metadata.name' will be used.
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	// +optional
 	ResourceID *string `json:"resourceID,omitempty"`
 
diff --git a/apis/privilegedaccessmanager/v1beta1/privilegedaccessmanagerentitlement_types.go b/apis/privilegedaccessmanager/v1beta1/privilegedaccessmanagerentitlement_types.go
index 345c9b5555..0f0c6ed834 100644
--- a/apis/privilegedaccessmanager/v1beta1/privilegedaccessmanagerentitlement_types.go
+++ b/apis/privilegedaccessmanager/v1beta1/privilegedaccessmanagerentitlement_types.go
@@ -51,7 +51,7 @@ type PrivilegedAccessManagerEntitlementSpec struct {
 	// Immutable.
 	// The PrivilegedAccessManagerEntitlement name. If not given, the
 	// 'metadata.name' will be used.
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	// +optional
 	ResourceID *string `json:"resourceID,omitempty"`
 
diff --git a/apis/secretmanager/v1beta1/secret_types.go b/apis/secretmanager/v1beta1/secret_types.go
index 9c9418ebff..4dc4a945db 100644
--- a/apis/secretmanager/v1beta1/secret_types.go
+++ b/apis/secretmanager/v1beta1/secret_types.go
@@ -28,9 +28,8 @@ var SecretManagerSecretGVK = GroupVersion.WithKind("SecretManagerSecret")
 // SecretManagerSecretSpec defines the desired state of SecretManagerSecret
 // +kcc:proto=google.cloud.secretmanager.v1.Secret
 type SecretManagerSecretSpec struct {
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The SecretManagerSecret name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Immutable. The replication policy of the secret data attached to
diff --git a/apis/securesourcemanager/v1alpha1/repository_types.go b/apis/securesourcemanager/v1alpha1/repository_types.go
index dd035b63c8..c2225c36b6 100644
--- a/apis/securesourcemanager/v1alpha1/repository_types.go
+++ b/apis/securesourcemanager/v1alpha1/repository_types.go
@@ -35,9 +35,8 @@ type SecureSourceManagerRepositorySpec struct {
 	// +required
 	Location string `json:"location"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The SecureSourceManagerRepository name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// The name of the instance in which the repository is hosted, formatted as
diff --git a/apis/spanner/v1beta1/instance_types.go b/apis/spanner/v1beta1/instance_types.go
index f719b8d00a..84a4d5f9f9 100644
--- a/apis/spanner/v1beta1/instance_types.go
+++ b/apis/spanner/v1beta1/instance_types.go
@@ -45,9 +45,8 @@ type SpannerInstanceSpec struct {
 	// +optional
 	ProcessingUnits *int32 `json:"processingUnits,omitempty"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The SpannerInstance name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 }
 
diff --git a/apis/workstations/v1alpha1/cluster_types.go b/apis/workstations/v1alpha1/cluster_types.go
index 5666536904..47b67346cb 100644
--- a/apis/workstations/v1alpha1/cluster_types.go
+++ b/apis/workstations/v1alpha1/cluster_types.go
@@ -36,9 +36,8 @@ type WorkstationClusterSpec struct {
 	// The location of the cluster.
 	Location string `json:"location,omitempty"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The WorkstationCluster name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Human-readable name for this workstation cluster.
diff --git a/apis/workstations/v1alpha1/config_types.go b/apis/workstations/v1alpha1/config_types.go
index 97e489150c..7783423b81 100644
--- a/apis/workstations/v1alpha1/config_types.go
+++ b/apis/workstations/v1alpha1/config_types.go
@@ -274,9 +274,8 @@ type WorkstationConfigSpec struct {
 	// Parent is a reference to the parent WorkstationCluster for this WorkstationConfig.
 	Parent *WorkstationClusterRef `json:"parentRef"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The WorkstationConfig name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Human-readable name for this workstation configuration.
diff --git a/apis/workstations/v1alpha1/workstation_types.go b/apis/workstations/v1alpha1/workstation_types.go
index 04eaecaf22..5a4e289cee 100644
--- a/apis/workstations/v1alpha1/workstation_types.go
+++ b/apis/workstations/v1alpha1/workstation_types.go
@@ -27,9 +27,8 @@ type WorkstationSpec struct {
 	// Parent is a reference to the parent WorkstationConfig for this Workstation.
 	Parent *WorkstationConfigRef `json:"parentRef"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The Workstation name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Human-readable name for this workstation.
diff --git a/apis/workstations/v1beta1/cluster_types.go b/apis/workstations/v1beta1/cluster_types.go
index b22184de3e..a0dd6ddeed 100644
--- a/apis/workstations/v1beta1/cluster_types.go
+++ b/apis/workstations/v1beta1/cluster_types.go
@@ -36,9 +36,8 @@ type WorkstationClusterSpec struct {
 	// The location of the cluster.
 	Location string `json:"location,omitempty"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The WorkstationCluster name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Human-readable name for this workstation cluster.
diff --git a/apis/workstations/v1beta1/config_types.go b/apis/workstations/v1beta1/config_types.go
index aa2f1c7e30..22128f9977 100644
--- a/apis/workstations/v1beta1/config_types.go
+++ b/apis/workstations/v1beta1/config_types.go
@@ -274,9 +274,8 @@ type WorkstationConfigSpec struct {
 	// Parent is a reference to the parent WorkstationCluster for this WorkstationConfig.
 	Parent *WorkstationClusterRef `json:"parentRef"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The WorkstationConfig name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Human-readable name for this workstation configuration.
diff --git a/apis/workstations/v1beta1/workstation_types.go b/apis/workstations/v1beta1/workstation_types.go
index 2e7f3ed29a..97541122ff 100644
--- a/apis/workstations/v1beta1/workstation_types.go
+++ b/apis/workstations/v1beta1/workstation_types.go
@@ -27,9 +27,8 @@ type WorkstationSpec struct {
 	// Parent is a reference to the parent WorkstationConfig for this Workstation.
 	Parent *WorkstationConfigRef `json:"parentRef"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The Workstation name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string `json:"resourceID,omitempty"`
 
 	// Optional. Human-readable name for this workstation.
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_bigquerydatatransferconfigs.bigquerydatatransfer.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_bigquerydatatransferconfigs.bigquerydatatransfer.cnrm.cloud.google.com.yaml
index 20938cd828..fe62114671 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_bigquerydatatransferconfigs.bigquerydatatransfer.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_bigquerydatatransferconfigs.bigquerydatatransfer.cnrm.cloud.google.com.yaml
@@ -232,12 +232,10 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. The BigQueryDataTransferConfig name. If not
-                  given, the metadata.name will be used.
+                description: The BigQueryDataTransferConfig name. If not given, the
+                  metadata.name will be used. Cannot be changed after create, except
+                  for updating from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               schedule:
                 description: |-
                   Data transfer schedule.
@@ -621,12 +619,10 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. The BigQueryDataTransferConfig name. If not
-                  given, the metadata.name will be used.
+                description: The BigQueryDataTransferConfig name. If not given, the
+                  metadata.name will be used. Cannot be changed after create, except
+                  for updating from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               schedule:
                 description: |-
                   Data transfer schedule.
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_certificatemanagerdnsauthorizations.certificatemanager.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_certificatemanagerdnsauthorizations.certificatemanager.cnrm.cloud.google.com.yaml
index 87beb40017..7bf8dcb8f6 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_certificatemanagerdnsauthorizations.certificatemanager.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_certificatemanagerdnsauthorizations.certificatemanager.cnrm.cloud.google.com.yaml
@@ -107,13 +107,11 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. Optional. The name of the resource. Used for
-                  creation and acquisition. When unset, the value of `metadata.name`
-                  is used as the default.
+                description: Optional. The name of the resource. Used for creation
+                  and acquisition. When unset, the value of `metadata.name` is used
+                  as the default. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - domain
             - projectRef
@@ -270,13 +268,11 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. Optional. The name of the resource. Used for
-                  creation and acquisition. When unset, the value of `metadata.name`
-                  is used as the default.
+                description: Optional. The name of the resource. Used for creation
+                  and acquisition. When unset, the value of `metadata.name` is used
+                  as the default. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - domain
             - projectRef
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_computetargettcpproxies.compute.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_computetargettcpproxies.compute.cnrm.cloud.google.com.yaml
index 185478604c..d47d0574ce 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_computetargettcpproxies.compute.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_computetargettcpproxies.compute.cnrm.cloud.google.com.yaml
@@ -116,12 +116,10 @@ spec:
                   ["NONE", "PROXY_V1"].'
                 type: string
               resourceID:
-                description: Immutable. The ComputeTargetTCPProxy name. If not given,
-                  the metadata.name will be used.
+                description: The ComputeTargetTCPProxy name. If not given, the metadata.name
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID is immutable
-                  rule: self == oldSelf
             required:
             - backendServiceRef
             type: object
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_containerattachedclusters.containerattached.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_containerattachedclusters.containerattached.cnrm.cloud.google.com.yaml
index db85a59b96..ff56fef34d 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_containerattachedclusters.containerattached.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_containerattachedclusters.containerattached.cnrm.cloud.google.com.yaml
@@ -270,12 +270,10 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable, Optional. The ContainerAttachedCluster name.
-                  If not given, the metadata.name will be used.
+                description: Optional. The ContainerAttachedCluster name. If not given,
+                  the metadata.name will be used. Cannot be changed after create,
+                  except for updating from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - distribution
             - fleet
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_discoveryenginedatastores.discoveryengine.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_discoveryenginedatastores.discoveryengine.cnrm.cloud.google.com.yaml
index eeb6980193..31feadaadc 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_discoveryenginedatastores.discoveryengine.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_discoveryenginedatastores.discoveryengine.cnrm.cloud.google.com.yaml
@@ -121,12 +121,10 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. The DiscoveryEngineDataStore name. If not
-                  given, the metadata.name will be used.
+                description: The DiscoveryEngineDataStore name. If not given, the
+                  metadata.name will be used. Cannot be changed after create, except
+                  for updating from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               solutionTypes:
                 description: |-
                   The solutions that the data store enrolls. Available solutions for each
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_kmskeyhandles.kms.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_kmskeyhandles.kms.cnrm.cloud.google.com.yaml
index 0032590863..9bcc7f6c6c 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_kmskeyhandles.kms.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_kmskeyhandles.kms.cnrm.cloud.google.com.yaml
@@ -96,15 +96,14 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: 'Immutable. The KMS Key Handle ID used for resource creation
-                  or acquisition. For creation: If specified, this value is used as
-                  the key handle ID. If not provided, a UUID will be generated and
-                  assigned as the key handle ID. For acquisition: This field must
-                  be provided to identify the key handle resource to acquire.'
+                description: 'The KMS Key Handle ID used for resource creation or
+                  acquisition. For creation: If specified, this value is used as the
+                  key handle ID. If not provided, a UUID will be generated and assigned
+                  as the key handle ID. For acquisition: This field must be provided
+                  to identify the key handle resource to acquire. Cannot be changed
+                  after create, except for updating from empty string to the actual
+                  resource ID.'
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               resourceTypeSelector:
                 description: Indicates the resource type that the resulting [CryptoKey][]
                   is meant to protect, e.g. `{SERVICE}.googleapis.com/{TYPE}`. See
@@ -239,15 +238,14 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: 'Immutable. The KMS Key Handle ID used for resource creation
-                  or acquisition. For creation: If specified, this value is used as
-                  the key handle ID. If not provided, a UUID will be generated and
-                  assigned as the key handle ID. For acquisition: This field must
-                  be provided to identify the key handle resource to acquire.'
+                description: 'The KMS Key Handle ID used for resource creation or
+                  acquisition. For creation: If specified, this value is used as the
+                  key handle ID. If not provided, a UUID will be generated and assigned
+                  as the key handle ID. For acquisition: This field must be provided
+                  to identify the key handle resource to acquire. Cannot be changed
+                  after create, except for updating from empty string to the actual
+                  resource ID.'
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               resourceTypeSelector:
                 description: Indicates the resource type that the resulting [CryptoKey][]
                   is meant to protect, e.g. `{SERVICE}.googleapis.com/{TYPE}`. See
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_privilegedaccessmanagerentitlements.privilegedaccessmanager.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_privilegedaccessmanagerentitlements.privilegedaccessmanager.cnrm.cloud.google.com.yaml
index 33ed8273e2..8ec36b2411 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_privilegedaccessmanagerentitlements.privilegedaccessmanager.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_privilegedaccessmanagerentitlements.privilegedaccessmanager.cnrm.cloud.google.com.yaml
@@ -303,12 +303,10 @@ spec:
                     x-kubernetes-preserve-unknown-fields: true
                 type: object
               resourceID:
-                description: Immutable. The PrivilegedAccessManagerEntitlement name.
-                  If not given, the 'metadata.name' will be used.
+                description: The PrivilegedAccessManagerEntitlement name. If not given,
+                  the 'metadata.name' will be used. Cannot be changed after create,
+                  except for updating from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - eligibleUsers
             - location
@@ -671,11 +669,10 @@ spec:
                 type: object
               resourceID:
                 description: Immutable. The PrivilegedAccessManagerEntitlement name.
-                  If not given, the 'metadata.name' will be used.
+                  If not given, the 'metadata.name' will be used. Cannot be changed
+                  after create, except for updating from empty string to the actual
+                  resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - eligibleUsers
             - location
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_secretmanagersecrets.secretmanager.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_secretmanagersecrets.secretmanager.cnrm.cloud.google.com.yaml
index 22597ec76f..c951e79f96 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_secretmanagersecrets.secretmanager.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_secretmanagersecrets.secretmanager.cnrm.cloud.google.com.yaml
@@ -239,12 +239,10 @@ spec:
                     type: object
                 type: object
               resourceID:
-                description: Immutable. The SecretManagerSecret name. If not given,
-                  the metadata.name will be used.
+                description: The SecretManagerSecret name. If not given, the metadata.name
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               rotation:
                 description: Optional. Rotation policy attached to the [Secret][google.cloud.secretmanager.v1.Secret].
                   May be excluded if there is no rotation policy.
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_securesourcemanagerrepositories.securesourcemanager.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_securesourcemanagerrepositories.securesourcemanager.cnrm.cloud.google.com.yaml
index 8e6014f8c6..7370e6d5b6 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_securesourcemanagerrepositories.securesourcemanager.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_securesourcemanagerrepositories.securesourcemanager.cnrm.cloud.google.com.yaml
@@ -268,12 +268,10 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. The SecureSourceManagerRepository name. If
-                  not given, the metadata.name will be used.
+                description: The SecureSourceManagerRepository name. If not given,
+                  the metadata.name will be used. Cannot be changed after create,
+                  except for updating from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - instanceRef
             - location
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_spannerinstances.spanner.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_spannerinstances.spanner.cnrm.cloud.google.com.yaml
index 29863500fc..5e506239d9 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_spannerinstances.spanner.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_spannerinstances.spanner.cnrm.cloud.google.com.yaml
@@ -83,12 +83,10 @@ spec:
                 format: int32
                 type: integer
               resourceID:
-                description: Immutable. The SpannerInstance name. If not given, the
-                  metadata.name will be used.
+                description: The SpannerInstance name. If not given, the metadata.name
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - config
             - displayName
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationclusters.workstations.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationclusters.workstations.cnrm.cloud.google.com.yaml
index aab34cd682..017c95217a 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationclusters.workstations.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationclusters.workstations.cnrm.cloud.google.com.yaml
@@ -202,12 +202,10 @@ spec:
                 - message: ResourceID field is immutable
                   rule: self == oldSelf
               resourceID:
-                description: Immutable. The WorkstationCluster name. If not given,
-                  the metadata.name will be used.
+                description: The WorkstationCluster name. If not given, the metadata.name
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               subnetworkRef:
                 description: Immutable. Reference to the Compute Engine subnetwork
                   in which instances associated with this workstation cluster will
@@ -548,12 +546,10 @@ spec:
                 - message: ResourceID field is immutable
                   rule: self == oldSelf
               resourceID:
-                description: Immutable. The WorkstationCluster name. If not given,
-                  the metadata.name will be used.
+                description: The WorkstationCluster name. If not given, the metadata.name
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               subnetworkRef:
                 description: Immutable. Reference to the Compute Engine subnetwork
                   in which instances associated with this workstation cluster will
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationconfigs.workstations.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationconfigs.workstations.cnrm.cloud.google.com.yaml
index 9c688483fe..50aecec4b0 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationconfigs.workstations.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstationconfigs.workstations.cnrm.cloud.google.com.yaml
@@ -506,12 +506,10 @@ spec:
                   type: string
                 type: array
               resourceID:
-                description: Immutable. The WorkstationConfig name. If not given,
-                  the metadata.name will be used.
+                description: The WorkstationConfig name. If not given, the metadata.name
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               runningTimeout:
                 description: |-
                   Optional. Number of seconds that a workstation can run until it is
@@ -1136,12 +1134,10 @@ spec:
                   type: string
                 type: array
               resourceID:
-                description: Immutable. The WorkstationConfig name. If not given,
-                  the metadata.name will be used.
+                description: The WorkstationConfig name. If not given, the metadata.name
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               runningTimeout:
                 description: |-
                   Optional. Number of seconds that a workstation can run until it is
diff --git a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstations.workstations.cnrm.cloud.google.com.yaml b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstations.workstations.cnrm.cloud.google.com.yaml
index e3fcb20429..e23c2be9ae 100644
--- a/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstations.workstations.cnrm.cloud.google.com.yaml
+++ b/config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_workstations.workstations.cnrm.cloud.google.com.yaml
@@ -118,12 +118,10 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. The Workstation name. If not given, the metadata.name
-                  will be used.
+                description: The Workstation name. If not given, the metadata.name
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - parentRef
             type: object
@@ -310,12 +308,10 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. The Workstation name. If not given, the metadata.name
-                  will be used.
+                description: The Workstation name. If not given, the metadata.name
+                  will be used. Cannot be changed after create, except for updating
+                  from empty string to the actual resource ID.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - parentRef
             type: object
diff --git a/dev/tools/controllerbuilder/template/apis/types.go b/dev/tools/controllerbuilder/template/apis/types.go
index 6821e94681..26d017d11e 100644
--- a/dev/tools/controllerbuilder/template/apis/types.go
+++ b/dev/tools/controllerbuilder/template/apis/types.go
@@ -37,9 +37,8 @@ var {{ .Kind }}GVK = GroupVersion.WithKind("{{ .Kind }}")
 // +kcc:proto={{ .KindProtoTag }}
 {{- end }}
 type {{ .Kind }}Spec struct {
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable"
-	// Immutable.
 	// The {{ .Kind }} name. If not given, the metadata.name will be used.
+	// Cannot be changed after create, except for updating from empty string to the actual resource ID.
 	ResourceID *string ` + "`" + `json:"resourceID,omitempty"` + "`" + `
 }
 
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/bigquerydatatransfer/bigquerydatatransferconfig.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/bigquerydatatransfer/bigquerydatatransferconfig.md
index 133b139f81..8cc7474b5b 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/bigquerydatatransfer/bigquerydatatransferconfig.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/bigquerydatatransfer/bigquerydatatransferconfig.md
@@ -387,7 +387,7 @@ serviceAccountRef:
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Immutable. The BigQueryDataTransferConfig name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The BigQueryDataTransferConfig name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
     <tr>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/certificatemanager/certificatemanagerdnsauthorization.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/certificatemanager/certificatemanagerdnsauthorization.md
index 7edeac39a5..5afbf2b9fa 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/certificatemanager/certificatemanagerdnsauthorization.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/certificatemanager/certificatemanagerdnsauthorization.md
@@ -168,7 +168,7 @@ resourceID: string
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default.{% endverbatim %}</p>
+            <p>{% verbatim %}Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
 </tbody>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/compute/computetargettcpproxy.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/compute/computetargettcpproxy.md
index ea27c12cb6..d01c07c9fa 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/compute/computetargettcpproxy.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/compute/computetargettcpproxy.md
@@ -182,7 +182,7 @@ resourceID: string
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Immutable. The ComputeTargetTCPProxy name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The ComputeTargetTCPProxy name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
 </tbody>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/containerattached/containerattachedcluster.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/containerattached/containerattachedcluster.md
index 072d78a671..c14594b33e 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/containerattached/containerattachedcluster.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/containerattached/containerattachedcluster.md
@@ -512,7 +512,7 @@ while clusters with private issuers need to provide both 'issuerUrl' and 'jwks'.
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Immutable, Optional. The ContainerAttachedCluster name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}Optional. The ContainerAttachedCluster name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
 </tbody>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/kms/kmskeyhandle.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/kms/kmskeyhandle.md
index 19d558294b..fbda7ed506 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/kms/kmskeyhandle.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/kms/kmskeyhandle.md
@@ -147,7 +147,7 @@ resourceTypeSelector: string
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Immutable. The KMS Key Handle ID used for resource creation or acquisition. For creation: If specified, this value is used as the key handle ID. If not provided, a UUID will be generated and assigned as the key handle ID. For acquisition: This field must be provided to identify the key handle resource to acquire.{% endverbatim %}</p>
+            <p>{% verbatim %}The KMS Key Handle ID used for resource creation or acquisition. For creation: If specified, this value is used as the key handle ID. If not provided, a UUID will be generated and assigned as the key handle ID. For acquisition: This field must be provided to identify the key handle resource to acquire. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
     <tr>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/privilegedaccessmanager/privilegedaccessmanagerentitlement.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/privilegedaccessmanager/privilegedaccessmanagerentitlement.md
index 9a73baa71c..9833be7cc6 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/privilegedaccessmanager/privilegedaccessmanagerentitlement.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/privilegedaccessmanager/privilegedaccessmanagerentitlement.md
@@ -562,7 +562,7 @@ https://cloud.google.com/iam/docs/conditions-overview#attributes.{% endverbatim
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Immutable. The PrivilegedAccessManagerEntitlement name. If not given, the 'metadata.name' will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}Immutable. The PrivilegedAccessManagerEntitlement name. If not given, the 'metadata.name' will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
 </tbody>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/secretmanager/secretmanagersecret.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/secretmanager/secretmanagersecret.md
index 042d553949..16fa71d199 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/secretmanager/secretmanagersecret.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/secretmanager/secretmanagersecret.md
@@ -395,7 +395,7 @@ versionAliases:
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Immutable. The SecretManagerSecret name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The SecretManagerSecret name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
     <tr>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/spanner/spannerinstance.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/spanner/spannerinstance.md
index 1acaec36cf..703c07f20c 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/spanner/spannerinstance.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/spanner/spannerinstance.md
@@ -159,7 +159,7 @@ resourceID: string
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Immutable. The SpannerInstance name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The SpannerInstance name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
 </tbody>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstation.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstation.md
index c7ed37994f..bc375f68e6 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstation.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstation.md
@@ -219,7 +219,7 @@ resourceID: string
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Immutable. The Workstation name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The Workstation name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
 </tbody>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationcluster.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationcluster.md
index 7507fef4ea..ffa548beaa 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationcluster.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationcluster.md
@@ -376,7 +376,7 @@ subnetworkRef:
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Immutable. The WorkstationCluster name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The WorkstationCluster name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
     <tr>
diff --git a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationconfig.md b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationconfig.md
index 989eb6f1d9..230574ff09 100644
--- a/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationconfig.md
+++ b/scripts/generate-google3-docs/resource-reference/generated/resource-docs/workstations/workstationconfig.md
@@ -955,7 +955,7 @@ runningTimeout: string
         </td>
         <td>
             <p><code class="apitype">string</code></p>
-            <p>{% verbatim %}Immutable. The WorkstationConfig name. If not given, the metadata.name will be used.{% endverbatim %}</p>
+            <p>{% verbatim %}The WorkstationConfig name. If not given, the metadata.name will be used. Cannot be changed after create, except for updating from empty string to the actual resource ID.{% endverbatim %}</p>
         </td>
     </tr>
     <tr>