diff --git a/modules/meshstack/noop/backplane/main.tf b/modules/meshstack/noop/backplane/main.tf
index 50599fb99..c43f1c08a 100644
--- a/modules/meshstack/noop/backplane/main.tf
+++ b/modules/meshstack/noop/backplane/main.tf
@@ -45,6 +45,11 @@ resource "google_secret_manager_secret" "runner_private_key" {
 resource "google_secret_manager_secret_version" "runner_private_key" {
   secret         = google_secret_manager_secret.runner_private_key.id
   secret_data_wo = resource.tls_private_key.runner.private_key_pem_pkcs8
+
+  # google 8.x requires this alongside secret_data_wo (7.x accepted it alone). A write-only value
+  # is absent from state, so the provider cannot see it change — bump this counter to push a new
+  # key into the secret.
+  secret_data_wo_version = 1
 }
 
 resource "google_secret_manager_secret" "runner_config" {
diff --git a/modules/meshstack/noop/backplane/versions.tf b/modules/meshstack/noop/backplane/versions.tf
index 91ce98f6f..e5cae3d09 100644
--- a/modules/meshstack/noop/backplane/versions.tf
+++ b/modules/meshstack/noop/backplane/versions.tf
@@ -4,11 +4,11 @@ terraform {
   required_providers {
     tls = {
       source  = "hashicorp/tls"
-      version = "~> 4.0"
+      version = ">= 4.0"
     }
     google = {
       source  = "hashicorp/google"
-      version = "~> 7.0"
+      version = ">= 7.0"
     }
     meshstack = {
       source  = "meshcloud/meshstack"
@@ -16,7 +16,7 @@ terraform {
     }
     time = {
       source  = "hashicorp/time"
-      version = "~> 0.12"
+      version = ">= 0.12"
     }
   }
 }
diff --git a/modules/meshstack/noop/e2e/runner/terraform.tf b/modules/meshstack/noop/e2e/runner/terraform.tf
index bd4e078f8..5e11410b2 100644
--- a/modules/meshstack/noop/e2e/runner/terraform.tf
+++ b/modules/meshstack/noop/e2e/runner/terraform.tf
@@ -6,12 +6,10 @@ terraform {
       source = "meshcloud/meshstack"
     }
     google = {
-      source  = "hashicorp/google"
-      version = "~> 7.0"
+      source = "hashicorp/google"
     }
     tls = {
-      source  = "hashicorp/tls"
-      version = "~> 4.0"
+      source = "hashicorp/tls"
     }
   }
 }