diff --git a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/upgrade-provider.yml b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/upgrade-provider.yml
index a80aa3050..35396c662 100644
--- a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/upgrade-provider.yml
+++ b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/upgrade-provider.yml
@@ -1,3 +1,4 @@
+#{{ if .Config.checkUpstreamUpgrade -}}#
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
 name: Upgrade provider
@@ -71,3 +72,4 @@ jobs:
         if: steps.target_version.outputs.version != ''
         run: upgrade-provider "${{ github.repository }}" --kind="all" --target-version="${{ steps.target_version.outputs.version }}" #{{ if .Config.javaGenVersion }}#--java-version="#{{ .Config.javaGenVersion }}#"#{{ end }}#
         shell: bash
+#{{ end }}#
\ No newline at end of file
diff --git a/provider-ci/internal/pkg/templates/defaults.config.yaml b/provider-ci/internal/pkg/templates/defaults.config.yaml
index f5acfe695..ce4c73aed 100644
--- a/provider-ci/internal/pkg/templates/defaults.config.yaml
+++ b/provider-ci/internal/pkg/templates/defaults.config.yaml
@@ -185,6 +185,10 @@ publish:
 # Enables automatic registry index doc file generation. Intended for use with Tier 2/3 providers.
 registryDocs: false
 
+# checkUpstreamUpgrade determines whether we run the upstream upgrade job for bridged providers.
+# Set to false for providers that cannot be upgraded, e.g. because of archived upstream or a license conflict.
+checkUpstreamUpgrade: true
+
 # Set a path for each language example to enable the test
 # releaseVerification:
   # nodejs: examples/simple-nodejs
@@ -254,4 +258,4 @@ registryDocs: false
 #    # but do say mention (in README.md) that they are under Apache-2.0."
 #    - github.com/alibabacloud-go/endpoint-util/service
 #    - github.com/alibabacloud-go/tea-roa-utils/service
-#    - github.com/alibabacloud-go/tea-roa/client
\ No newline at end of file
+#    - github.com/alibabacloud-go/tea-roa/client
diff --git a/provider-ci/test-providers/cloudflare/.ci-mgmt.yaml b/provider-ci/test-providers/cloudflare/.ci-mgmt.yaml
index 2249bff35..fb835017a 100644
--- a/provider-ci/test-providers/cloudflare/.ci-mgmt.yaml
+++ b/provider-ci/test-providers/cloudflare/.ci-mgmt.yaml
@@ -25,4 +25,5 @@ actions:
       run: |
         cd provider && go test -v -json -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
 pulumiConvert: 1
-registryDocs: true
\ No newline at end of file
+registryDocs: true
+checkUpstreamUpgrade: false
\ No newline at end of file
diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/upgrade-provider.yml b/provider-ci/test-providers/cloudflare/.github/workflows/upgrade-provider.yml
deleted file mode 100644
index 22386fa72..000000000
--- a/provider-ci/test-providers/cloudflare/.github/workflows/upgrade-provider.yml
+++ /dev/null
@@ -1,61 +0,0 @@
-# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
-
-name: Upgrade provider
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: |
-          The version of the upstream provider to upgrade to, without the 'v' prefix
-          
-          If no version is specified, it will be inferred from the upstream provider's release tags.
-        required: false
-        type: string
-  schedule:
-    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
-    - cron: 0 3 * * *
-
-env:
-  GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-jobs:
-  upgrade_provider:
-    name: upgrade-provider
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v4
-        with:
-          # Persist credentials so upgrade-provider can push a new branch.
-          persist-credentials: true
-      - name: Setup tools
-        uses: ./.github/actions/setup-tools
-        with:
-          tools: pulumictl, pulumicli, nodejs, python, dotnet, go, java
-      - name: Install upgrade-provider
-        run: go install github.com/pulumi/upgrade-provider@main
-        shell: bash
-      - name: "Set up git identity"
-        run: |
-          git config --global user.name 'bot@pulumi.com'
-          git config --global user.email 'bot@pulumi.com'
-        shell: bash
-      - name: Create issues for new upstream version
-        if: inputs.version == ''
-        id: upstream_version
-        # This step outputs `latest_version` if there is a pending upgrade
-        run: upgrade-provider "$REPO" --kind=check-upstream-version
-        env:
-          REPO: ${{ github.repository }}
-        shell: bash
-      - name: Calculate target version
-        id: target_version
-        # Prefer the manually specified version if it exists
-        # upstream_version will be empty if the provider is up-to-date
-        run: echo "version=${{ github.event.inputs.version || steps.upstream_version.outputs.latest_version }}" >> "$GITHUB_OUTPUT"
-        shell: bash
-      - name: Attempt provider upgrade
-        # Only attempt the upgrade if we have a target version
-        if: steps.target_version.outputs.version != ''
-        run: upgrade-provider "${{ github.repository }}" --kind="all" --target-version="${{ steps.target_version.outputs.version }}" 
-        shell: bash