diff --git a/pkg/test/resourcefixture/testdata/basic/container/v1beta1/containernodepool/_generated_object_containernodepool.golden.yaml b/pkg/test/resourcefixture/testdata/basic/container/v1beta1/containernodepool/_generated_object_containernodepool.golden.yaml
index 4ed75bfc0b..24c45f5363 100644
--- a/pkg/test/resourcefixture/testdata/basic/container/v1beta1/containernodepool/_generated_object_containernodepool.golden.yaml
+++ b/pkg/test/resourcefixture/testdata/basic/container/v1beta1/containernodepool/_generated_object_containernodepool.golden.yaml
@@ -35,12 +35,12 @@ spec:
     metadata:
       disable-legacy-endpoints: "true"
     oauthScopes:
+    - https://www.googleapis.com/auth/devstorage.read_only
+    - https://www.googleapis.com/auth/logging.write
     - https://www.googleapis.com/auth/monitoring
     - https://www.googleapis.com/auth/service.management.readonly
     - https://www.googleapis.com/auth/servicecontrol
     - https://www.googleapis.com/auth/trace.append
-    - https://www.googleapis.com/auth/devstorage.read_only
-    - https://www.googleapis.com/auth/logging.write
     serviceAccountRef:
       external: default
     shieldedInstanceConfig:
diff --git a/pkg/test/resourcefixture/testdata/directives/removedefaultnodepool/_generated_object_removedefaultnodepool.golden.yaml b/pkg/test/resourcefixture/testdata/directives/removedefaultnodepool/_generated_object_removedefaultnodepool.golden.yaml
index f3ad327227..fca26a4ddd 100644
--- a/pkg/test/resourcefixture/testdata/directives/removedefaultnodepool/_generated_object_removedefaultnodepool.golden.yaml
+++ b/pkg/test/resourcefixture/testdata/directives/removedefaultnodepool/_generated_object_removedefaultnodepool.golden.yaml
@@ -53,12 +53,12 @@ spec:
   nodeConfig:
     loggingVariant: DEFAULT
     oauthScopes:
-    - https://www.googleapis.com/auth/trace.append
     - https://www.googleapis.com/auth/devstorage.read_only
     - https://www.googleapis.com/auth/logging.write
     - https://www.googleapis.com/auth/monitoring
     - https://www.googleapis.com/auth/service.management.readonly
     - https://www.googleapis.com/auth/servicecontrol
+    - https://www.googleapis.com/auth/trace.append
   nodeLocations:
   - us-central1-a
   nodeVersion: ""
diff --git a/tests/e2e/normalize.go b/tests/e2e/normalize.go
index 5a873e7548..fa5417f7e6 100644
--- a/tests/e2e/normalize.go
+++ b/tests/e2e/normalize.go
@@ -100,6 +100,7 @@ func normalizeKRMObject(u *unstructured.Unstructured, project testgcp.GCPProject
 	visitor.sortSlices = sets.New[string]()
 	// TODO: This should not be needed, we want to avoid churning the kube objects
 	visitor.sortSlices.Insert(".spec.access")
+	visitor.sortSlices.Insert(".spec.nodeConfig.oauthScopes")
 
 	visitor.stringTransforms = append(visitor.stringTransforms, func(path string, s string) string {
 		return strings.ReplaceAll(s, project.ProjectID, "${projectId}")