diff --git a/addons/api/addon/generated/models/host-catalog.js b/addons/api/addon/generated/models/host-catalog.js
index eb8b84342..6c5770790 100644
--- a/addons/api/addon/generated/models/host-catalog.js
+++ b/addons/api/addon/generated/models/host-catalog.js
@@ -73,14 +73,14 @@ export default class GeneratedHostCatalogModel extends BaseModel {
 
   @attr('string', {
     isNestedAttribute: true,
-    readOnly: true,
+    writeOnce: true,
     description: '',
   })
   access_key_id;
 
   @attr('string', {
     isNestedAttribute: true,
-    readOnly: true,
+    writeOnce: true,
     description: '',
   })
   secret_access_key;
@@ -107,14 +107,14 @@ export default class GeneratedHostCatalogModel extends BaseModel {
 
   @attr('string', {
     isNestedAttribute: true,
-    readOnly: true,
+    writeOnce: true,
     description: '',
   })
   secret_id;
 
   @attr('string', {
     isNestedAttribute: true,
-    readOnly: true,
+    writeOnce: true,
     description: '',
   })
   secret_value;
diff --git a/addons/api/addon/serializers/application.js b/addons/api/addon/serializers/application.js
index cb61f1a34..26d215219 100644
--- a/addons/api/addon/serializers/application.js
+++ b/addons/api/addon/serializers/application.js
@@ -43,6 +43,8 @@ export default class ApplicationSerializer extends RESTSerializer {
     if (type === 'string' && json[key] === '') json[key] = null;
     // Do not serialize read-only attributes.
     if (options.readOnly) delete json[key];
+    // Only serialize write-once fields on create.
+    if (options.writeOnce && !snapshot.record.isNew) delete json[key];
     // Version is sent only if it has a non-nullish value
     if (key === 'version') {
       if (json[key] === null || json[key] === undefined) delete json[key];
diff --git a/addons/api/tests/unit/serializers/host-catalog-test.js b/addons/api/tests/unit/serializers/host-catalog-test.js
index 5cf3480fc..e56024cd6 100644
--- a/addons/api/tests/unit/serializers/host-catalog-test.js
+++ b/addons/api/tests/unit/serializers/host-catalog-test.js
@@ -40,7 +40,7 @@ module('Unit | Serializer | host catalog', function (hooks) {
     assert.deepEqual(serializedRecord, expectedResult);
   });
 
-  test('it serializes an AWS plugin as expected, ignoring read-only and Azure fields', async function (assert) {
+  test('it serializes an AWS plugin as expected, ignoring Azure fields', async function (assert) {
     assert.expect(1);
     const store = this.owner.lookup('service:store');
     const serializer = store.serializerFor('host-catalog');
@@ -76,7 +76,7 @@ module('Unit | Serializer | host catalog', function (hooks) {
     assert.deepEqual(serializedRecord, expectedResult);
   });
 
-  test('it serializes an Azure plugin as expected, ignoring read-only and Aws fields', async function (assert) {
+  test('it serializes an Azure plugin as expected, ignoring AWS fields', async function (assert) {
     assert.expect(1);
     const store = this.owner.lookup('service:store');
     const serializer = store.serializerFor('host-catalog');