diff --git a/modules/gitea_instance/modules/branch_protection/main.tf b/modules/gitea_instance/modules/branch_protection/main.tf
index d4e4282..929bd8e 100644
--- a/modules/gitea_instance/modules/branch_protection/main.tf
+++ b/modules/gitea_instance/modules/branch_protection/main.tf
@@ -24,4 +24,16 @@ resource "gitea_repository_branch_protection" "this" {
   require_signed_commits                  = var.require_signed_commits
   protected_file_patterns                 = var.protected_file_patterns
   unprotected_file_patterns               = var.unprotected_file_patterns
+
+  lifecycle {
+    # Gitea resolves whitelist names to IDs and returns them ordered by repo-reader (user ID for users, name for teams), dropping any entity without repo access, so the read-back representation never matches the config and plans a spurious update every run.
+    ignore_changes = [
+      push_whitelist_users,
+      push_whitelist_teams,
+      merge_whitelist_users,
+      merge_whitelist_teams,
+      approval_whitelist_users,
+      approval_whitelist_teams,
+    ]
+  }
 }