diff --git a/agent/grpc-external/services/resource/write.go b/agent/grpc-external/services/resource/write.go
index 34799ae8d8..831998c33b 100644
--- a/agent/grpc-external/services/resource/write.go
+++ b/agent/grpc-external/services/resource/write.go
@@ -72,14 +72,14 @@ func (s *Server) Write(ctx context.Context, req *pbresource.WriteRequest) (*pbre
 		)
 	}
 
-	if err = reg.Validate(req.Resource); err != nil {
-		return nil, status.Error(codes.InvalidArgument, err.Error())
-	}
-
 	if err = reg.Mutate(req.Resource); err != nil {
 		return nil, status.Errorf(codes.Internal, "failed mutate hook: %v", err.Error())
 	}
 
+	if err = reg.Validate(req.Resource); err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
 	// At the storage backend layer, all writes are CAS operations.
 	//
 	// This makes it possible to *safely* do things like keeping the Uid stable
diff --git a/internal/resource/registry.go b/internal/resource/registry.go
index 0004acfff4..1baaf0bdd1 100644
--- a/internal/resource/registry.go
+++ b/internal/resource/registry.go
@@ -42,11 +42,9 @@ type Registration struct {
 	// check for required fields).
 	Validate func(*pbresource.Resource) error
 
-	// Mutate is called to fill out any autogenerated fields (e.g. UUIDs).
+	// Mutate is called to fill out any autogenerated fields (e.g. UUIDs) or
+	// apply defaults before validation.
 	Mutate func(*pbresource.Resource) error
-
-	// In the future, we'll add hooks, the controller etc. here.
-	// TODO: https://github.com/hashicorp/consul/pull/16622#discussion_r1134515909
 }
 
 type ACLHooks struct {