diff --git a/twingate/internal/provider/resource/resource.go b/twingate/internal/provider/resource/resource.go
index a5986633..4dc8e390 100644
--- a/twingate/internal/provider/resource/resource.go
+++ b/twingate/internal/provider/resource/resource.go
@@ -827,10 +827,10 @@ func (r *twingateResource) Update(ctx context.Context, req resource.UpdateReques
 
 	if resource != nil {
 		resource.IsAuthoritative = input.IsAuthoritative
-	}
 
-	if planSecurityPolicy != nil && *planSecurityPolicy == "" {
-		resource.SecurityPolicyID = planSecurityPolicy
+		if planSecurityPolicy != nil && *planSecurityPolicy == "" {
+			resource.SecurityPolicyID = planSecurityPolicy
+		}
 	}
 
 	r.helper(ctx, resource, &state, &plan, &resp.State, &resp.Diagnostics, err, operationUpdate)
diff --git a/twingate/internal/test/acctests/resource/resource_test.go b/twingate/internal/test/acctests/resource/resource_test.go
index 7b67bbe0..b81df06c 100644
--- a/twingate/internal/test/acctests/resource/resource_test.go
+++ b/twingate/internal/test/acctests/resource/resource_test.go
@@ -2,11 +2,12 @@ package resource
 
 import (
 	"fmt"
-	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+
 	"github.com/Twingate/terraform-provider-twingate/v3/twingate/internal/attr"
 	"github.com/Twingate/terraform-provider-twingate/v3/twingate/internal/model"
 	"github.com/Twingate/terraform-provider-twingate/v3/twingate/internal/provider/resource"
@@ -2047,6 +2048,49 @@ func TestAccTwingateResourceCreateWithAlias(t *testing.T) {
 	})
 }
 
+func TestAccTwingateResourceUpdateWithInvalidAlias(t *testing.T) {
+	const terraformResourceName = "test29_update_invalid"
+	theResource := acctests.TerraformResource(terraformResourceName)
+	remoteNetworkName := test.RandomName()
+	resourceName := test.RandomResourceName()
+
+	sdk.Test(t, sdk.TestCase{
+		ProtoV6ProviderFactories: acctests.ProviderFactories,
+		PreCheck:                 func() { acctests.PreCheck(t) },
+		CheckDestroy:             acctests.CheckTwingateResourceDestroy,
+		Steps: []sdk.TestStep{
+			{
+				Config: createResource29WithoutAlias(terraformResourceName, remoteNetworkName, resourceName),
+				Check: acctests.ComposeTestCheckFunc(
+					sdk.TestCheckNoResourceAttr(theResource, attr.Alias),
+				),
+			},
+			{
+				Config:      createResource29(terraformResourceName, remoteNetworkName, resourceName, "test-com"),
+				ExpectError: regexp.MustCompile("Alias must be a[\\n\\s]+valid DNS name"),
+			},
+		},
+	})
+}
+
+func TestAccTwingateResourceCreateWithInvalidAlias(t *testing.T) {
+	const terraformResourceName = "test29_create_invalid"
+	remoteNetworkName := test.RandomName()
+	resourceName := test.RandomResourceName()
+
+	sdk.Test(t, sdk.TestCase{
+		ProtoV6ProviderFactories: acctests.ProviderFactories,
+		PreCheck:                 func() { acctests.PreCheck(t) },
+		CheckDestroy:             acctests.CheckTwingateResourceDestroy,
+		Steps: []sdk.TestStep{
+			{
+				Config:      createResource29(terraformResourceName, remoteNetworkName, resourceName, "test-com"),
+				ExpectError: regexp.MustCompile("Alias must be a[\\n\\s]+valid DNS name"),
+			},
+		},
+	})
+}
+
 func createResource29(terraformResourceName, networkName, resourceName, aliasName string) string {
 	return fmt.Sprintf(`
 	resource "twingate_remote_network" "%s" {