diff --git a/civo/instances/resource_instance.go b/civo/instances/resource_instance.go
index 285a8471..42610a25 100644
--- a/civo/instances/resource_instance.go
+++ b/civo/instances/resource_instance.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/base64"
 	"errors"
+	"fmt"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"log"
 	"strings"
@@ -189,6 +190,7 @@ func ResourceInstance() *schema.Resource {
 			Update: schema.DefaultTimeout(30 * time.Minute),
 			Delete: schema.DefaultTimeout(30 * time.Minute),
 		},
+		CustomizeDiff: customizeDiffInstance,
 	}
 }
 
@@ -610,3 +612,10 @@ func resourceInstanceDelete(ctx context.Context, d *schema.ResourceData, m inter
 
 	return nil
 }
+
+func customizeDiffInstance(ctx context.Context, d *schema.ResourceDiff, meta interface{}) error {
+	if d.Id() != "" && d.HasChange("script") {
+		return fmt.Errorf("the 'script' field is immutable")
+	}
+	return nil
+}
diff --git a/docs/resources/instance.md b/docs/resources/instance.md
index a1eb5f50..cb1284bc 100644
--- a/docs/resources/instance.md
+++ b/docs/resources/instance.md
@@ -139,7 +139,7 @@ resource "civo_instance" "example" {
 - `region` (String) The region for the instance, if not declare we use the region in declared in the provider
 - `reserved_ipv4` (String) Can be either the UUID, name, or the IP address of the reserved IP
 - `reverse_dns` (String) A fully qualified domain name that should be used as the instance's IP's reverse DNS (optional, uses the hostname if unspecified)
-- `script` (String) The contents of a script that will be uploaded to /usr/local/bin/civo-user-init-script on your instance, read/write/executable only by root and then will be executed at the end of the cloud initialization
+- `script` (String) The contents of a script that will be uploaded to /usr/local/bin/civo-user-init-script on your instance, read/write/executable only by root and then will be executed at the end of the cloud initialization (this is an immutable field)
 - `size` (String) The name of the size, from the current list, e.g. g3.xsmall
 - `sshkey_id` (String) The ID of an already uploaded SSH public key to use for login to the default user (optional; if one isn't provided a random password will be set and returned in the initial_password field)
 - `tags` (Set of String) An optional list of tags, represented as a key, value pair