diff --git a/crd/multitenancy/api/v1alpha1/multitenantpodnetworkconfig.go b/crd/multitenancy/api/v1alpha1/multitenantpodnetworkconfig.go
index dba7fdd117..715d22d028 100644
--- a/crd/multitenancy/api/v1alpha1/multitenantpodnetworkconfig.go
+++ b/crd/multitenancy/api/v1alpha1/multitenantpodnetworkconfig.go
@@ -37,6 +37,7 @@ type MultitenantPodNetworkConfigList struct {
 }
 
 // MultitenantPodNetworkConfigSpec defines the desired state of PodNetworkConfig
+// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec is immutable after creation"
 type MultitenantPodNetworkConfigSpec struct {
 	// name of PNI object from requesting cx pod
 	// +kubebuilder:validation:Optional
diff --git a/crd/multitenancy/manifests/multitenancy.acn.azure.com_multitenantpodnetworkconfigs.yaml b/crd/multitenancy/manifests/multitenancy.acn.azure.com_multitenantpodnetworkconfigs.yaml
index 9390424b82..be65733175 100644
--- a/crd/multitenancy/manifests/multitenancy.acn.azure.com_multitenantpodnetworkconfigs.yaml
+++ b/crd/multitenancy/manifests/multitenancy.acn.azure.com_multitenantpodnetworkconfigs.yaml
@@ -68,6 +68,9 @@ spec:
             required:
             - podNetwork
             type: object
+            x-kubernetes-validations:
+            - message: spec is immutable after creation
+              rule: self == oldSelf
           status:
             description: MultitenantPodNetworkConfigStatus defines the observed state
               of PodNetworkConfig