diff --git a/examples/pnpm-lock.yaml b/examples/pnpm-lock.yaml
index 807552c..2837c6e 100644
--- a/examples/pnpm-lock.yaml
+++ b/examples/pnpm-lock.yaml
@@ -7484,7 +7484,7 @@ packages:
     dev: false
 
   file:../lib/dist/cdk-practical-constructs-0.0.1.tgz(@asteasolutions/zod-to-openapi@7.0.0)(aws-cdk-lib@2.155.0)(zod@3.23.8):
-    resolution: {integrity: sha512-HqhjDpUeGE4sBDq9ikCokw8vTjzfWBl5JrSNsBtdq8OtD8VlopjRCWTpyYtbHVz0wuy9wEGQvn+9NaoBWorkdw==, tarball: file:../lib/dist/cdk-practical-constructs-0.0.1.tgz}
+    resolution: {integrity: sha512-5H/Y7HRg2tf0OEC6ec5v9o4shBUJOg2YdekWB2qC0Du/Rwv9cL/iH9SYJCevv9sv2wqZ+Pg/skYEHczgUenm8Q==, tarball: file:../lib/dist/cdk-practical-constructs-0.0.1.tgz}
     id: file:../lib/dist/cdk-practical-constructs-0.0.1.tgz
     name: cdk-practical-constructs
     version: 0.0.1
diff --git a/lib/src/wso2/utils-cdk.ts b/lib/src/wso2/utils-cdk.ts
index 8f4bf24..4fc0990 100644
--- a/lib/src/wso2/utils-cdk.ts
+++ b/lib/src/wso2/utils-cdk.ts
@@ -26,6 +26,9 @@ export const addLambdaAndProviderForWso2Operations = (args: {
 
   const { accountId, region } = new ScopedAws(args.scope);
 
+  // never use network configuration, only explicit VPC from previous step
+  const { network, ...customResourceConfig } = args.props.customResourceConfig ?? {};
+
   // resolve the entry file from workspace (.ts file), or
   // from the dist dir (.js file) when being used as a lib
   let wso2LambdaEntry = `${args.baseDir}/handler/index.ts`;
@@ -35,7 +38,6 @@ export const addLambdaAndProviderForWso2Operations = (args: {
 
   // vpc is undefined if no network is defined
   let vpc: IVpc | undefined;
-  const { customResourceConfig } = args.props;
 
   const securityGroups = [];
 
@@ -43,10 +45,6 @@ export const addLambdaAndProviderForWso2Operations = (args: {
   if (args.props.customResourceConfig?.network) {
     vpc = vpcFromConfig(args.scope, args.props.customResourceConfig.network);
 
-    // never use network configuration, only explicit VPC from previous step
-    // eslint-disable-next-line fp/no-delete
-    delete customResourceConfig?.network;
-
     if (
       !customResourceConfig?.securityGroups ||
       customResourceConfig?.securityGroups.length === 0