diff --git a/assets/terraform/test/resource_vsys_test.go b/assets/terraform/test/resource_vsys_test.go
new file mode 100644
index 00000000..7e7cb3ed
--- /dev/null
+++ b/assets/terraform/test/resource_vsys_test.go
@@ -0,0 +1,123 @@
+package provider_test
+
+import (
+	"fmt"
+	"regexp"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/config"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/knownvalue"
+	"github.com/hashicorp/terraform-plugin-testing/statecheck"
+	"github.com/hashicorp/terraform-plugin-testing/tfjsonpath"
+)
+
+// TestAccPanosVsys_ConflictWithTemplateDefaultVsys verifies that creating a
+// panos_vsys resource for "vsys1" fails when the template already has
+// default_vsys = "vsys1" (because the template's PostCreate hook already
+// created that vsys entry).
+func TestAccPanosVsys_ConflictWithTemplateDefaultVsys(t *testing.T) {
+	t.Parallel()
+
+	nameSuffix := acctest.RandStringFromCharSet(6, acctest.CharSetAlphaNum)
+	prefix := fmt.Sprintf("test-acc-%s", nameSuffix)
+
+	location := config.ObjectVariable(map[string]config.Variable{
+		"panorama": config.ObjectVariable(map[string]config.Variable{}),
+	})
+
+	configVars := map[string]config.Variable{
+		"prefix":   config.StringVariable(prefix),
+		"location": location,
+	}
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testAccPreCheck(t) },
+		ProtoV6ProviderFactories: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config:          vsys_ConflictWithTemplateDefaultVsys_Tmpl,
+				ConfigVariables: configVars,
+				ExpectError:     regexp.MustCompile(`.`),
+			},
+		},
+	})
+}
+
+const vsys_ConflictWithTemplateDefaultVsys_Tmpl = `
+variable "prefix" { type = string }
+variable "location" { type = any }
+
+resource "panos_template" "test" {
+  location = var.location
+  name     = "${var.prefix}-template"
+  default_vsys = "vsys1"
+}
+
+resource "panos_vsys" "vsys1" {
+  location = {
+    template = {
+      name = panos_template.test.name
+    }
+  }
+  name = "vsys1"
+}
+`
+
+// TestAccPanosVsys_WithTemplate verifies that creating a panos_vsys resource
+// for "vsys2" succeeds when the template has default_vsys = "vsys1" (a
+// different vsys name, so no conflict).
+func TestAccPanosVsys_WithTemplate(t *testing.T) {
+	t.Parallel()
+
+	nameSuffix := acctest.RandStringFromCharSet(6, acctest.CharSetAlphaNum)
+	prefix := fmt.Sprintf("test-acc-%s", nameSuffix)
+
+	location := config.ObjectVariable(map[string]config.Variable{
+		"panorama": config.ObjectVariable(map[string]config.Variable{}),
+	})
+
+	configVars := map[string]config.Variable{
+		"prefix":   config.StringVariable(prefix),
+		"location": location,
+	}
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testAccPreCheck(t) },
+		ProtoV6ProviderFactories: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config:          vsys_WithTemplate_Tmpl,
+				ConfigVariables: configVars,
+				ConfigStateChecks: []statecheck.StateCheck{
+					statecheck.ExpectKnownValue(
+						"panos_vsys.vsys2",
+						tfjsonpath.New("name"),
+						knownvalue.StringExact("vsys2"),
+					),
+				},
+			},
+		},
+	})
+}
+
+const vsys_WithTemplate_Tmpl = `
+variable "prefix" { type = string }
+variable "location" { type = any }
+
+resource "panos_template" "test" {
+  location = var.location
+  name     = "${var.prefix}-template"
+  default_vsys = "vsys1"
+}
+
+resource "panos_vsys" "vsys2" {
+  location = {
+    template = {
+      name = panos_template.test.name
+    }
+  }
+  name = "vsys2"
+}
+`
diff --git a/pkg/translate/imports.go b/pkg/translate/imports.go
index 9f4d1157..50960d92 100644
--- a/pkg/translate/imports.go
+++ b/pkg/translate/imports.go
@@ -24,8 +24,10 @@ func RenderImports(spec *properties.Normalization, templateTypes ...string) (str
 			manager.AddStandardImport("fmt", "")
 			manager.AddSdkImport("github.com/PaloAltoNetworks/pango/filtering", "")
 			manager.AddSdkImport("github.com/PaloAltoNetworks/pango/generic", "")
-			manager.AddSdkImport("github.com/PaloAltoNetworks/pango/util", "")
 			manager.AddSdkImport("github.com/PaloAltoNetworks/pango/version", "")
+			if len(spec.Spec.Params) > 0 || len(spec.Spec.OneOf) > 0 {
+				manager.AddSdkImport("github.com/PaloAltoNetworks/pango/util", "")
+			}
 
 			if spec.HasParametersWithStrconv() {
 				manager.AddStandardImport("errors", "")
diff --git a/specs/device/vsys.yaml b/specs/device/vsys.yaml
new file mode 100644
index 00000000..f9758a29
--- /dev/null
+++ b/specs/device/vsys.yaml
@@ -0,0 +1,98 @@
+name: vsys
+terraform_provider_config:
+  description: Proxy configuration
+  skip_resource: false
+  skip_datasource: false
+  resource_type: entry
+  resource_variants: []
+  suffix: vsys
+  plural_suffix: ''
+  plural_name: ''
+  plural_description: ''
+go_sdk_config:
+  skip: false
+  package:
+  - device
+  - vsys
+panos_xpath:
+  path:
+  - vsys
+  vars: []
+locations:
+- name: template
+  xpath:
+    path:
+    - config
+    - devices
+    - $panorama_device
+    - template
+    - $template
+    - config
+    - devices
+    - $ngfw_device
+    vars:
+    - name: panorama_device
+      description: Specific Panorama device
+      required: false
+      default: localhost.localdomain
+      validators: []
+      type: entry
+    - name: template
+      description: Specific Panorama template
+      required: true
+      validators: []
+      type: entry
+    - name: ngfw_device
+      description: The NGFW device
+      required: false
+      default: localhost.localdomain
+      validators: []
+      type: entry
+  description: Located in a specific template
+  devices:
+  - panorama
+  validators: []
+  required: false
+  read_only: false
+- name: template-stack
+  xpath:
+    path:
+    - config
+    - devices
+    - $panorama_device
+    - template-stack
+    - $template_stack
+    - config
+    - devices
+    - $ngfw_device
+    vars:
+    - name: panorama_device
+      description: Specific Panorama device
+      required: false
+      default: localhost.localdomain
+      validators: []
+      type: entry
+    - name: template_stack
+      description: Specific Panorama template stack
+      required: true
+      validators: []
+      type: entry
+    - name: ngfw_device
+      description: The NGFW device
+      required: false
+      default: localhost.localdomain
+      validators: []
+      type: entry
+  description: Located in a specific template stack
+  devices:
+  - panorama
+  validators: []
+  required: false
+  read_only: false
+entries:
+- name: name
+  description: ''
+  validators: []
+spec:
+  params: []
+  variants: []