diff --git a/lib/plugins/aws/provider.js b/lib/plugins/aws/provider.js
index 62240f097..c1292843d 100644
--- a/lib/plugins/aws/provider.js
+++ b/lib/plugins/aws/provider.js
@@ -1522,7 +1522,17 @@ class AwsProvider {
               ],
             },
             versionFunction: { $ref: '#/definitions/awsLambdaVersioning' },
-            vpc: { $ref: '#/definitions/awsLambdaVpcConfig' },
+            vpc: {
+              // Function-level opt-out: `false`/`null` exclude this function from
+              // the provider VPC. The compile step (package/compile/functions.js)
+              // already handles both, so this function-level schema must accept
+              // them too, otherwise strict validation rejects a valid opt-out.
+              anyOf: [
+                { $ref: '#/definitions/awsLambdaVpcConfig' },
+                { const: false },
+                { type: 'null' },
+              ],
+            },
             httpApi: {
               type: 'object',
               properties: {
diff --git a/test/unit/lib/plugins/aws/package/compile/functions.test.js b/test/unit/lib/plugins/aws/package/compile/functions.test.js
index f95c767d1..e57bde78f 100644
--- a/test/unit/lib/plugins/aws/package/compile/functions.test.js
+++ b/test/unit/lib/plugins/aws/package/compile/functions.test.js
@@ -2588,6 +2588,10 @@ describe('lib/plugins/aws/package/compile/functions/index.test.js', () => {
               vpc: null,
               handler: 'index.handler',
             },
+            vpcDisabled: {
+              vpc: false,
+              handler: 'index.handler',
+            },
           },
         },
       });
@@ -2639,6 +2643,12 @@ describe('lib/plugins/aws/package/compile/functions/index.test.js', () => {
       expect(Properties.VpcConfig).to.be.undefined;
     });
 
+    it('should allow `functions[].vpc` set to `false` to opt out of `provider.vpc`', () => {
+      const Properties = cfResources[naming.getLambdaLogicalId('vpcDisabled')].Properties;
+
+      expect(Properties.VpcConfig).to.be.undefined;
+    });
+
     it('should support `provider.tags`', () => {
       const providerConfig = serviceConfig.provider;