diff --git a/.changelog/38636.txt b/.changelog/38636.txt
new file mode 100644
index 00000000000..ea4013993e9
--- /dev/null
+++ b/.changelog/38636.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+provider: Fix empty tags drift on fwprovider resources
+```
diff --git a/internal/provider/fwprovider/intercept.go b/internal/provider/fwprovider/intercept.go
index dec32c03c67..f7050ca9cbe 100644
--- a/internal/provider/fwprovider/intercept.go
+++ b/internal/provider/fwprovider/intercept.go
@@ -516,7 +516,8 @@ func (r tagsResourceInterceptor) read(ctx context.Context, request resource.Read
 		apiTags := tagsInContext.TagsOut.UnwrapOrDefault()
 
 		// AWS APIs often return empty lists of tags when none have been configured.
-		stateTags := tftags.Null
+		var stateTags fwtypes.Map
+		response.State.GetAttribute(ctx, path.Root(names.AttrTags), &stateTags)
 		// Remove any provider configured ignore_tags and system tags from those returned from the service API.
 		// The resource's configured tags do not include any provider configured default_tags.
 		if v := apiTags.IgnoreSystem(inContext.ServicePackageName).IgnoreConfig(tagsInContext.IgnoreConfig).ResolveDuplicatesFramework(ctx, tagsInContext.DefaultConfig, tagsInContext.IgnoreConfig, response, diags).Map(); len(v) > 0 {
diff --git a/internal/service/networkmonitor/monitor_test.go b/internal/service/networkmonitor/monitor_test.go
index 17be63198f2..c65a725ced0 100644
--- a/internal/service/networkmonitor/monitor_test.go
+++ b/internal/service/networkmonitor/monitor_test.go
@@ -65,6 +65,13 @@ func TestAccNetworkMonitorMonitor_tags(t *testing.T) {
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMonitorDestroy(ctx),
 		Steps: []resource.TestStep{
+			{
+				Config: testAccMonitorConfig_tags0(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckMonitorExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsPercent, acctest.Ct0),
+				),
+			},
 			{
 				Config: testAccMonitorConfig_tags1(rName, acctest.CtKey1, acctest.CtValue1),
 				Check: resource.ComposeTestCheckFunc(
@@ -172,6 +179,17 @@ resource "aws_networkmonitor_monitor" "test" {
 `, rName, aggregation)
 }
 
+func testAccMonitorConfig_tags0(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_networkmonitor_monitor" "test" {
+  aggregation_period = 30
+  monitor_name       = %[1]q
+
+  tags = {}
+}
+`, rName)
+}
+
 func testAccMonitorConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_networkmonitor_monitor" "test" {