diff --git a/mmv1/products/networkconnectivity/Transport.yaml b/mmv1/products/networkconnectivity/Transport.yaml
index 2cdf6f29d08a..f090391706fa 100644
--- a/mmv1/products/networkconnectivity/Transport.yaml
+++ b/mmv1/products/networkconnectivity/Transport.yaml
@@ -121,11 +121,15 @@ properties:
   - name: network
     type: ResourceRef
     description: |
-      Resource URL of the Network that will be peered with this Transport. This field must be provided during resource creation and cannot be changed.
+      Resource URL of the Network that will be peered with this Transport.
+      Exactly one of `network` or `hub` must be specified. This field is
+      immutable and cannot be changed after creation.
     immutable: true
     resource: Network
     imports: selfLink
-    required: true
+    exactly_one_of:
+      - hub
+      - network
   - name: advertisedRoutes
     type: Array
     description: |
@@ -144,11 +148,16 @@ properties:
   - name: hub
     type: ResourceRef
     description: |
-      The NCC Hub that the Transport should attach to. The hub must be in the same project as the Transport.
+      The NCC Hub that the Transport should attach to. The hub must be in the
+      same project as the Transport. Exactly one of `network` or `hub` must be
+      specified. This field is immutable and cannot be changed after creation.
     min_version: beta
     resource: Hub
     imports: selfLink
     immutable: true
+    exactly_one_of:
+      - hub
+      - network
   - name: pscRoutingEnabled
     type: Boolean
     description: |
diff --git a/mmv1/third_party/terraform/services/networkconnectivity/resource_network_connectivity_transport_internal_test.go b/mmv1/third_party/terraform/services/networkconnectivity/resource_network_connectivity_transport_internal_test.go
new file mode 100644
index 000000000000..abc8ee0d3487
--- /dev/null
+++ b/mmv1/third_party/terraform/services/networkconnectivity/resource_network_connectivity_transport_internal_test.go
@@ -0,0 +1,51 @@
+package networkconnectivity
+
+import (
+	"slices"
+	"testing"
+)
+
+// TestUnitNetworkConnectivityTransport_networkHubExactlyOneOf guards against
+// regressions of https://github.com/hashicorp/terraform-provider-google/issues/28425
+// where `network` was incorrectly Required, blocking NCC hub-only Transports.
+func TestUnitNetworkConnectivityTransport_networkHubExactlyOneOf(t *testing.T) {
+	t.Parallel()
+
+	r := ResourceNetworkConnectivityTransport()
+
+	network, ok := r.Schema["network"]
+	if !ok {
+		t.Fatal("expected network in schema")
+	}
+	if network.Required {
+		t.Error("network must not be Required; exactly one of network or hub must be set")
+	}
+	if !network.Optional {
+		t.Error("network should be Optional")
+	}
+	if !slices.Contains(network.ExactlyOneOf, "network") {
+		t.Errorf("network ExactlyOneOf = %v, want to include network", network.ExactlyOneOf)
+	}
+
+	hub, ok := r.Schema["hub"]
+	if !ok {
+		// hub is beta-only; on GA it is omitted and ExactlyOneOf is filtered to network alone.
+		if len(network.ExactlyOneOf) != 1 || network.ExactlyOneOf[0] != "network" {
+			t.Errorf("GA network ExactlyOneOf = %v, want [network]", network.ExactlyOneOf)
+		}
+		return
+	}
+
+	if hub.Required {
+		t.Error("hub must not be Required")
+	}
+	if !hub.Optional {
+		t.Error("hub should be Optional")
+	}
+	if !slices.Contains(network.ExactlyOneOf, "hub") {
+		t.Errorf("network ExactlyOneOf = %v, want to include hub", network.ExactlyOneOf)
+	}
+	if !slices.Contains(hub.ExactlyOneOf, "hub") || !slices.Contains(hub.ExactlyOneOf, "network") {
+		t.Errorf("hub ExactlyOneOf = %v, want hub and network", hub.ExactlyOneOf)
+	}
+}