diff --git a/config/networkfirewall/config.go b/config/networkfirewall/config.go
index cac046ddc4..62cd141098 100644
--- a/config/networkfirewall/config.go
+++ b/config/networkfirewall/config.go
@@ -76,6 +76,9 @@ func Configure(p *config.Provider) { // nolint:gocyclo
 					}
 				}
 			}
+			if diff.Attributes != nil {
+				delete(diff.Attributes, "firewall_status.#")
+			}
 			return diff, nil
 		}
 	})
diff --git a/examples/networkfirewall/firewall.yaml b/examples/networkfirewall/firewall.yaml
index b02016cb89..8dae458c08 100644
--- a/examples/networkfirewall/firewall.yaml
+++ b/examples/networkfirewall/firewall.yaml
@@ -4,11 +4,14 @@ metadata:
   annotations:
     uptest.upbound.io/timeout: "3600"
     meta.upbound.io/example-id: networkfirewall/v1beta1/firewall
+    uptest.upbound.io/update-parameter: '{"tags":{"update-test-tag":"val"}}'
   labels:
     testing.upbound.io/example-name: example
   name: firewallname
 spec:
   forProvider:
+    firewallPolicyChangeProtection: true
+    subnetChangeProtection: true
     firewallPolicyArnSelector:
       matchLabels:
         testing.upbound.io/example-name: example