diff --git a/pkgs/applications/networking/cluster/terraform-providers/update-provider b/pkgs/applications/networking/cluster/terraform-providers/update-provider
index 78bb4d2aa81b..3f78b37a266a 100755
--- a/pkgs/applications/networking/cluster/terraform-providers/update-provider
+++ b/pkgs/applications/networking/cluster/terraform-providers/update-provider
@@ -28,14 +28,12 @@ Options:
 
   * --force: Force the update even if the version matches.
   * --no-build: Don't build provider
-  * --vendor-hash <SRI-hash>: Override the SHA256 or "null".
 DOC
 }
 
+build=1
 force=
 provider=
-build=1
-vendorHash=
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -51,11 +49,6 @@ while [[ $# -gt 0 ]]; do
     build=0
     shift
     ;;
-  --vendor-hash)
-    force=1
-    vendorHash=$2
-    shift 2
-    ;;
   *)
     if [[ -n ${provider} ]]; then
       echo "ERROR: provider name was passed two times: '${provider}' and '$1'"
@@ -114,19 +107,19 @@ fi
 
 homepage="$(read_attr homepage)"
 
-old_vendor_hash=$(read_attr vendorHash)
-old_rev=$(read_attr rev)
-
 registry_response=$(curl -s "${homepage//providers/v1/providers}")
 
+old_rev="$(read_attr rev)"
 rev="$(jq -r '.tag' <<<"${registry_response}")"
-if [[ ${old_rev} == "${rev}" && ${force} != 1 && -z ${vendorHash} && ${old_vendor_hash} != "${vendorHash}" ]]; then
-  echo_provider "already at version ${rev}"
-  exit
-fi
-if [[ ${rev//v/} =~ [[:alpha:]] && ${force} != 1 ]]; then
-  echo_provider "not updating to unstable version ${rev}"
-  exit
+if [[ ${force} != 1 ]]; then
+  if [[ ${old_rev} == "${rev}" ]]; then
+    echo_provider "already at version ${rev}"
+    exit
+  fi
+  if [[ ${rev//v/} =~ [[:alpha:]] ]]; then
+    echo_provider "not updating to unstable version ${rev}"
+    exit
+  fi
 fi
 echo_provider "updating from ${old_rev} to ${rev}"
 update_attr rev "${rev}"
@@ -141,17 +134,13 @@ echo_provider "calculating hash"
 hash=$(generate_hash src)
 update_attr hash "${hash}"
 
-if [[ -z ${vendorHash} ]]; then
-  if [[ ${old_vendor_hash} == null ]]; then
-    vendorHash=null
-  else
-    echo_provider "calculating vendorHash"
-    vendorHash=$(generate_hash go-modules)
-  fi
+old_vendor_hash="$(read_attr vendorHash)"
+if [[ ${old_vendor_hash} != null ]]; then
+  echo_provider "calculating vendorHash"
+  vendorHash=$(generate_hash go-modules)
+  update_attr vendorHash "${vendorHash}"
 fi
 
-update_attr vendorHash "${vendorHash}"
-
 # Check that the provider builds
 if [[ ${build} == 1 ]]; then
   echo_provider "building"