diff --git a/x-pack/plugins/security_solution/public/common/components/toolbar/bulk_actions/use_bulk_alert_tags_items.tsx b/x-pack/plugins/security_solution/public/common/components/toolbar/bulk_actions/use_bulk_alert_tags_items.tsx
index e6e90e42755ab..977cb0bf8b315 100644
--- a/x-pack/plugins/security_solution/public/common/components/toolbar/bulk_actions/use_bulk_alert_tags_items.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/toolbar/bulk_actions/use_bulk_alert_tags_items.tsx
@@ -36,18 +36,22 @@ export const useBulkAlertTagsItems = ({ refetch }: UseBulkAlertTagsItemsProps) =
     [setAlertTags]
   );
 
-  const alertTagsItems = hasIndexWrite
-    ? [
-        {
-          key: 'manage-alert-tags',
-          'data-test-subj': 'alert-tags-context-menu-item',
-          name: i18n.ALERT_TAGS_CONTEXT_MENU_ITEM_TITLE,
-          panel: 1,
-          label: i18n.ALERT_TAGS_CONTEXT_MENU_ITEM_TITLE,
-          disableOnQuery: true,
-        },
-      ]
-    : [];
+  const alertTagsItems = useMemo(
+    () =>
+      hasIndexWrite
+        ? [
+            {
+              key: 'manage-alert-tags',
+              'data-test-subj': 'alert-tags-context-menu-item',
+              name: i18n.ALERT_TAGS_CONTEXT_MENU_ITEM_TITLE,
+              panel: 1,
+              label: i18n.ALERT_TAGS_CONTEXT_MENU_ITEM_TITLE,
+              disableOnQuery: true,
+            },
+          ]
+        : [],
+    [hasIndexWrite]
+  );
 
   const TitleContent = useMemo(
     () => (
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_alerts/alert_status.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_alerts/alert_status.cy.ts
index 7466f656a3071..c55c8f62dc4a9 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_alerts/alert_status.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_alerts/alert_status.cy.ts
@@ -38,12 +38,12 @@ import { visit } from '../../../tasks/navigation';
 import { ALERTS_URL } from '../../../urls/navigation';
 
 // FLAKY: https://github.com/elastic/kibana/issues/169091
-describe('Changing alert status', { tags: ['@ess', '@serverless'] }, () => {
+describe('Changing alert status', () => {
   before(() => {
     cy.task('esArchiverLoad', { archiveName: 'auditbeat_big' });
   });
 
-  context('Opening alerts', () => {
+  context('Opening alerts', { tags: ['@ess', '@serverless'] }, () => {
     beforeEach(() => {
       login();
       deleteAlertsAndRules();
@@ -124,7 +124,7 @@ describe('Changing alert status', { tags: ['@ess', '@serverless'] }, () => {
     });
   });
 
-  context('Marking alerts as acknowledged', () => {
+  context('Marking alerts as acknowledged', { tags: ['@ess', '@serverless'] }, () => {
     beforeEach(() => {
       login();
       deleteAlertsAndRules();
@@ -175,7 +175,7 @@ describe('Changing alert status', { tags: ['@ess', '@serverless'] }, () => {
     });
   });
 
-  context('Closing alerts', () => {
+  context('Closing alerts', { tags: ['@ess', '@serverless'] }, () => {
     beforeEach(() => {
       login();
       deleteAlertsAndRules();
@@ -237,7 +237,10 @@ describe('Changing alert status', { tags: ['@ess', '@serverless'] }, () => {
     });
   });
 
-  context('User is readonly', () => {
+  // This test is unable to be run in serverless as `reader` is not available and viewer is currently reserved
+  // https://github.com/elastic/kibana/pull/169723#issuecomment-1793191007
+  // https://github.com/elastic/kibana/issues/170583
+  context('User is readonly', { tags: ['@ess', '@brokenInServerless'] }, () => {
     beforeEach(() => {
       login();
       visit(ALERTS_URL);
@@ -247,7 +250,6 @@ describe('Changing alert status', { tags: ['@ess', '@serverless'] }, () => {
       visit(ALERTS_URL, { role: ROLES.reader });
       waitForAlertsToPopulate();
     });
-
     it('should not allow users to change a single alert status', () => {
       // This is due to the reader role which makes everything in security 'read only'
       cy.get(TIMELINE_CONTEXT_MENU_BTN).should('not.exist');