diff --git a/CHANGES.md b/CHANGES.md
index 943d2b67..a23ff4f2 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -12,9 +12,14 @@ Notable changes between versions.
 * Raise default CoreDNS replica count to the larger of 2 or the number of controller nodes ([#313](https://github.com/poseidon/typhoon/pull/313))
   * Add AntiAffinity preferred rule to favor spreading CoreDNS pods
 
+#### Azure
+
+* Remove admin_password field (disabled) since it is now optional
+  * Require `terraform-provider-azurerm` v1.16+ (action required)
+
 #### DigitalOcean
 
-* Require terraform-provider-digitalocean plugin 1.0 (or higher but < 2.0)
+* Require `terraform-provider-digitalocean` v1.0+ (action required)
 
 #### Addons
 
diff --git a/azure/container-linux/kubernetes/require.tf b/azure/container-linux/kubernetes/require.tf
new file mode 100644
index 00000000..731af74e
--- /dev/null
+++ b/azure/container-linux/kubernetes/require.tf
@@ -0,0 +1,26 @@
+# Terraform version and plugin versions
+
+terraform {
+  required_version = ">= 0.11.0"
+}
+
+provider "azurerm" {
+  version = "~> 1.16"
+}
+
+provider "local" {
+  version = "~> 1.0"
+}
+
+provider "null" {
+  version = "~> 1.0"
+}
+
+provider "template" {
+  version = "~> 1.0"
+}
+
+provider "tls" {
+  version = "~> 1.0"
+}
+
diff --git a/azure/container-linux/kubernetes/workers/workers.tf b/azure/container-linux/kubernetes/workers/workers.tf
index 13e1ecf5..7ca1c600 100644
--- a/azure/container-linux/kubernetes/workers/workers.tf
+++ b/azure/container-linux/kubernetes/workers/workers.tf
@@ -37,10 +37,7 @@ resource "azurerm_virtual_machine_scale_set" "workers" {
   os_profile {
     computer_name_prefix = "${var.name}-worker-"
     admin_username       = "core"
-
-    # Required by Azure, but password auth is disabled below
-    admin_password = ""
-    custom_data    = "${element(data.ct_config.worker-ignitions.*.rendered, count.index)}"
+    custom_data          = "${element(data.ct_config.worker-ignitions.*.rendered, count.index)}"
   }
 
   # Azure mandates setting an ssh_key, even though Ignition custom_data handles it too
diff --git a/docs/cl/azure.md b/docs/cl/azure.md
index 05fb41ec..8be22a10 100644
--- a/docs/cl/azure.md
+++ b/docs/cl/azure.md
@@ -58,7 +58,7 @@ Configure the Azure provider in a `providers.tf` file.
 
 ```tf
 provider "azurerm" {
-  version = "1.13.0"
+  version = "1.16.0"
   alias   = "default"
 }