diff --git a/autogen/main/versions.tf.tmpl b/autogen/main/versions.tf.tmpl
index 622ecd96ed..7da43df234 100644
--- a/autogen/main/versions.tf.tmpl
+++ b/autogen/main/versions.tf.tmpl
@@ -21,7 +21,7 @@ terraform {
 {% if beta_cluster %}
     google-beta = ">= 3.32.0, <4.0.0"
 {% else %}
-    google = ">= 3.16, <4.0.0"
+    google = ">= 3.39.0, <4.0.0"
 {% endif %}
   }
 }
diff --git a/docs/upgrading_to_v12.0.md b/docs/upgrading_to_v12.0.md
new file mode 100644
index 0000000000..fbb46a8b90
--- /dev/null
+++ b/docs/upgrading_to_v12.0.md
@@ -0,0 +1,57 @@
+# Upgrading to v12.0
+
+The v12.0 release of *kubernetes-engine* is a backwards incompatible
+release.
+
+### ASM module
+
+- GKE Hub functionality has been removed from ASM module and is now available as a separate [Hub submodule](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/tree/master/modules/hub).
+- This is destructive and will result in the destruction and reapplication of cluster registration and optional SA.
+
+```diff
+ module "asm" {
+   source               = "terraform-google-modules/kubernetes-engine/google//modules/asm"
+-  version              = "~> 11.0"
++  version              = "~> 12.0"
+}
++ module "hub" {
++   source               = "terraform-google-modules/kubernetes-engine/google//modules/hub"
++  version               = "~> 12.0"
+}
+```
+
+### Dropped support for `gcloud_skip_download` variable
+
+- The `gcloud_skip_download` has been removed across all modules/submodules in favor of a simplified environment variable flag.
+- Setting environment variable `GCLOUD_TF_DOWNLOAD` to `always` will download and install gcloud and is equivalent to `gcloud_skip_download = false`.
+- Additional documentation is available [here](https://github.com/terraform-google-modules/terraform-google-gcloud#downloading).
+
+### GA cluster defaults for new features
+
+- GA clusters now enable Workload Identity by default.
+
+If you would like to continue using the module without Workload Identity, you can override the default value.
+```diff
+ module "gke" {
+   source               = "terraform-google-modules/kubernetes-engine/google"
+-  version              = "~> 11.0"
++  version              = "~> 12.0"
++  identity_namespace   = null
+}
+```
+
+- GA clusters now enable Shielded Nodes by default.
+
+If you would like to continue using the module without Shielded Nodes, you can override the default value.
+```diff
+ module "gke" {
+   source                  = "terraform-google-modules/kubernetes-engine/google"
+-  version                 = "~> 11.0"
++  version                 = "~> 12.0"
++  enable_shielded_nodes   = false
+}
+```
+
+
+### Provider Version
+Support for Google provider versions older than v3.39 has been removed due to the introduction of [new features](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/644) in the GA module.
diff --git a/modules/private-cluster-update-variant/versions.tf b/modules/private-cluster-update-variant/versions.tf
index ed96650ec1..f23cfbc8e2 100644
--- a/modules/private-cluster-update-variant/versions.tf
+++ b/modules/private-cluster-update-variant/versions.tf
@@ -18,6 +18,6 @@ terraform {
   required_version = ">=0.12.6, <0.14"
 
   required_providers {
-    google = ">= 3.16, <4.0.0"
+    google = ">= 3.39.0, <4.0.0"
   }
 }
diff --git a/modules/private-cluster/versions.tf b/modules/private-cluster/versions.tf
index ed96650ec1..f23cfbc8e2 100644
--- a/modules/private-cluster/versions.tf
+++ b/modules/private-cluster/versions.tf
@@ -18,6 +18,6 @@ terraform {
   required_version = ">=0.12.6, <0.14"
 
   required_providers {
-    google = ">= 3.16, <4.0.0"
+    google = ">= 3.39.0, <4.0.0"
   }
 }
diff --git a/versions.tf b/versions.tf
index ed96650ec1..f23cfbc8e2 100644
--- a/versions.tf
+++ b/versions.tf
@@ -18,6 +18,6 @@ terraform {
   required_version = ">=0.12.6, <0.14"
 
   required_providers {
-    google = ">= 3.16, <4.0.0"
+    google = ">= 3.39.0, <4.0.0"
   }
 }