diff --git a/controllers/agentcluster_controller.go b/controllers/agentcluster_controller.go
index c023cd78..98cef29d 100644
--- a/controllers/agentcluster_controller.go
+++ b/controllers/agentcluster_controller.go
@@ -46,6 +46,7 @@ import (
 const (
 	agentClusterDependenciesWaitTime = 5 * time.Second
 	AgentClusterRefLabel             = "agentClusterRef"
+	HiveReconcilePauseAnnotation     = "hive.openshift.io/reconcile-pause"
 )
 
 var (
@@ -137,6 +138,12 @@ func (r *AgentClusterReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		return ctrl.Result{}, err
 	}
 
+	err = r.ensureClusterDeploymentAnnotations(ctx, clusterDeployment)
+	if err != nil {
+		log.WithError(err).Errorf("failed to ensure ClusterDeployment %s has Hive pause annotation", clusterDeployment.Name)
+		return ctrl.Result{}, err
+	}
+
 	err = r.ensureAgentClusterInstall(ctx, log, clusterDeployment, agentCluster)
 	if err != nil {
 		return ctrl.Result{}, err
@@ -270,6 +277,9 @@ func (r *AgentClusterReconciler) createClusterDeploymentObject(agentCluster *cap
 			Labels: map[string]string{
 				AgentClusterRefLabel: agentCluster.Name,
 			},
+			Annotations: map[string]string{
+				HiveReconcilePauseAnnotation: "true",
+			},
 		},
 		Spec: hivev1.ClusterDeploymentSpec{
 			Installed:   true,
@@ -344,6 +354,20 @@ func (r *AgentClusterReconciler) ensureOwnedClusterDeployment(ctx context.Contex
 	return nil
 }
 
+// ensureClusterDeploymentAnnotations makes sure that the ClusterDeployment has the hive pause annotation
+// to prevent Hive from reconciling it.
+func (r *AgentClusterReconciler) ensureClusterDeploymentAnnotations(ctx context.Context, clusterDeployment *hivev1.ClusterDeployment) error {
+	patch := client.MergeFrom(clusterDeployment.DeepCopy())
+	if clusterDeployment.ObjectMeta.Annotations == nil {
+		clusterDeployment.ObjectMeta.Annotations = make(map[string]string)
+	}
+	clusterDeployment.ObjectMeta.Annotations[HiveReconcilePauseAnnotation] = "true"
+	if err := r.Client.Patch(ctx, clusterDeployment, patch); err != nil {
+		return err
+	}
+	return nil
+}
+
 func (r *AgentClusterReconciler) ensureAgentClusterInstall(ctx context.Context, log logrus.FieldLogger, clusterDeployment *hivev1.ClusterDeployment, agentCluster *capiproviderv1.AgentCluster) error {
 	log.Info("Setting AgentClusterInstall")
 	agentClusterInstall := &hiveext.AgentClusterInstall{}
diff --git a/controllers/agentcluster_controller_test.go b/controllers/agentcluster_controller_test.go
index 41d9403c..c15a4b0c 100644
--- a/controllers/agentcluster_controller_test.go
+++ b/controllers/agentcluster_controller_test.go
@@ -223,7 +223,8 @@ var _ = Describe("agentcluster reconcile", func() {
 		Expect(clusterDeployment.OwnerReferences[0].Name).To(Equal(agentCluster.Name))
 		Expect(clusterDeployment.OwnerReferences[0].Kind).To(Equal(agentCluster.Kind))
 		Expect(clusterDeployment.OwnerReferences[0].APIVersion).To(Equal(agentCluster.APIVersion))
-
+		Expect(clusterDeployment.GetAnnotations()).NotTo(BeEmpty())
+		Expect(clusterDeployment.GetAnnotations()).To(HaveKey(HiveReconcilePauseAnnotation))
 	})
 	It("failed to find cluster", func() {
 		agentCluster := newAgentCluster("agentCluster-1", testNamespace, capiproviderv1.AgentClusterSpec{
@@ -408,6 +409,34 @@ var _ = Describe("agentcluster reconcile", func() {
 			Expect(c.Get(ctx, types.NamespacedName{Name: agentCluster.Name, Namespace: testNamespace}, agentCluster)).NotTo(Succeed())
 		})
 	})
+	It("should add the hive pause annotation to the clusterDeployment if missing", func() {
+		agentCluster := createDefaultResources(ctx, c, clusterName, testNamespace, baseDomain, pullSecret, kubeconfig, kubeadminPassword)
+		createAgentClusterInstall(c, ctx, agentCluster.Namespace, agentCluster.Name)
+		createClusterDeployment(c, ctx, agentCluster, clusterName, baseDomain, pullSecret)
+		key := types.NamespacedName{
+			Namespace: testNamespace,
+			Name:      clusterName,
+		}
+		clusterDeployment := &hivev1.ClusterDeployment{}
+		Expect(c.Get(ctx, key, clusterDeployment)).To(Succeed())
+		clusterDeployment.Labels = map[string]string{AgentClusterRefLabel: agentCluster.Name}
+		Expect(c.Update(ctx, clusterDeployment)).To(BeNil())
+		agentCluster.Spec.ControlPlaneEndpoint.Host = "1.2.3.4"
+		agentCluster.Spec.ControlPlaneEndpoint.Port = 1234
+		Expect(c.Update(ctx, agentCluster)).To(BeNil())
+		agentCluster.Status.ClusterDeploymentRef.Name = agentCluster.Name
+		agentCluster.Status.ClusterDeploymentRef.Namespace = agentCluster.Namespace
+		Expect(c.Status().Update(ctx, agentCluster)).To(BeNil())
+
+		result, err := acr.Reconcile(ctx, newAgentClusterRequest(agentCluster))
+		Expect(err).To(BeNil())
+		Expect(result).To(Equal(ctrl.Result{}))
+
+		err = c.Get(ctx, key, clusterDeployment)
+		Expect(err).To(BeNil())
+		Expect(clusterDeployment.GetAnnotations()).NotTo(BeEmpty())
+		Expect(clusterDeployment.GetAnnotations()).To(HaveKey(HiveReconcilePauseAnnotation))
+	})
 })
 
 func createClusterDeployment(c client.Client, ctx context.Context, agentCluster *capiproviderv1.AgentCluster, clusterName, baseDomain, pullSecretName string) {