diff --git a/pkg/model/network.go b/pkg/model/network.go
index fd8ba2bb47..24cd1699fd 100644
--- a/pkg/model/network.go
+++ b/pkg/model/network.go
@@ -270,7 +270,7 @@ func (b *NetworkModelBuilder) Build(c *fi.ModelBuilderContext) error {
 					Lifecycle: b.Lifecycle,
 					ID:        s(b.Cluster.Spec.Subnets[i].Egress),
 					Shared:    fi.Bool(true),
-					Tags:      b.CloudTags(zone+"."+b.ClusterName(), true),
+					Tags:      nil, // We don't need to add tags here
 				}
 
 				c.AddTask(in)
diff --git a/upup/pkg/fi/cloudup/awstasks/instance.go b/upup/pkg/fi/cloudup/awstasks/instance.go
index 3866c4b736..5f469a354c 100644
--- a/upup/pkg/fi/cloudup/awstasks/instance.go
+++ b/upup/pkg/fi/cloudup/awstasks/instance.go
@@ -156,7 +156,7 @@ func (e *Instance) Find(c *fi.Context) (*Instance, error) {
 		actual.IAMInstanceProfile = &IAMInstanceProfile{Name: nameFromIAMARN(i.IamInstanceProfile.Arn)}
 	}
 
-	actual.Tags = mapEC2TagsToMap(i.Tags)
+	actual.Tags = intersectTags(i.Tags, e.Tags)
 
 	actual.Lifecycle = e.Lifecycle
 	actual.Shared = e.Shared
@@ -195,10 +195,6 @@ func nameFromIAMARN(arn *string) *string {
 }
 
 func (e *Instance) Run(c *fi.Context) error {
-	cloud := c.Cloud.(awsup.AWSCloud)
-
-	cloud.AddTags(e.Name, e.Tags)
-
 	return fi.DefaultDeltaRunMethod(e, c)
 }