diff --git a/awx/api/serializers.py b/awx/api/serializers.py
index f70e582c89..29a90c08c3 100644
--- a/awx/api/serializers.py
+++ b/awx/api/serializers.py
@@ -2664,6 +2664,13 @@ class CredentialSerializer(BaseSerializer):
 
         return credential_type
 
+    def validate_inputs(self, inputs):
+        if self.instance and self.instance.credential_type.kind == "vault":
+            if 'vault_id' in inputs and inputs['vault_id'] != self.instance.inputs['vault_id']:
+                raise ValidationError(_('We do not permit Vault IDs to be changed after they have been created.'))
+
+        return inputs
+
 
 class CredentialSerializerCreate(CredentialSerializer):