diff --git a/autogen/safer-cluster/variables.tf.tmpl b/autogen/safer-cluster/variables.tf.tmpl
index 182162bb16..20fb353c30 100644
--- a/autogen/safer-cluster/variables.tf.tmpl
+++ b/autogen/safer-cluster/variables.tf.tmpl
@@ -500,7 +500,7 @@ variable "enable_mesh_certificates" {
 variable "workload_vulnerability_mode" {
   description = "(beta) Vulnerability mode."
   type        = string
-  default     = ""
+  default     = null
 }
 
 variable "workload_config_audit_mode" {
diff --git a/modules/safer-cluster-update-variant/README.md b/modules/safer-cluster-update-variant/README.md
index 915a8d8d55..3588e9fca2 100644
--- a/modules/safer-cluster-update-variant/README.md
+++ b/modules/safer-cluster-update-variant/README.md
@@ -273,7 +273,7 @@ For simplicity, we suggest using `roles/container.admin` and
 | upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | `list(string)` | `[]` | no |
 | windows\_node\_pools | List of maps containing node pools | `list(map(string))` | `[]` | no |
 | workload\_config\_audit\_mode | (beta) Workload config audit mode. | `string` | `"DISABLED"` | no |
-| workload\_vulnerability\_mode | (beta) Vulnerability mode. | `string` | `""` | no |
+| workload\_vulnerability\_mode | (beta) Vulnerability mode. | `string` | `null` | no |
 | zones | The zones to host the cluster in | `list(string)` | `[]` | no |
 
 ## Outputs
diff --git a/modules/safer-cluster-update-variant/variables.tf b/modules/safer-cluster-update-variant/variables.tf
index ec2b11849e..df7920f8c6 100644
--- a/modules/safer-cluster-update-variant/variables.tf
+++ b/modules/safer-cluster-update-variant/variables.tf
@@ -500,7 +500,7 @@ variable "enable_mesh_certificates" {
 variable "workload_vulnerability_mode" {
   description = "(beta) Vulnerability mode."
   type        = string
-  default     = ""
+  default     = null
 }
 
 variable "workload_config_audit_mode" {
diff --git a/modules/safer-cluster/README.md b/modules/safer-cluster/README.md
index 915a8d8d55..3588e9fca2 100644
--- a/modules/safer-cluster/README.md
+++ b/modules/safer-cluster/README.md
@@ -273,7 +273,7 @@ For simplicity, we suggest using `roles/container.admin` and
 | upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | `list(string)` | `[]` | no |
 | windows\_node\_pools | List of maps containing node pools | `list(map(string))` | `[]` | no |
 | workload\_config\_audit\_mode | (beta) Workload config audit mode. | `string` | `"DISABLED"` | no |
-| workload\_vulnerability\_mode | (beta) Vulnerability mode. | `string` | `""` | no |
+| workload\_vulnerability\_mode | (beta) Vulnerability mode. | `string` | `null` | no |
 | zones | The zones to host the cluster in | `list(string)` | `[]` | no |
 
 ## Outputs
diff --git a/modules/safer-cluster/variables.tf b/modules/safer-cluster/variables.tf
index ec2b11849e..df7920f8c6 100644
--- a/modules/safer-cluster/variables.tf
+++ b/modules/safer-cluster/variables.tf
@@ -500,7 +500,7 @@ variable "enable_mesh_certificates" {
 variable "workload_vulnerability_mode" {
   description = "(beta) Vulnerability mode."
   type        = string
-  default     = ""
+  default     = null
 }
 
 variable "workload_config_audit_mode" {