diff --git a/registry/coder/modules/vault-token/README.md b/registry/coder/modules/vault-token/README.md
index fada3fe..26428df 100644
--- a/registry/coder/modules/vault-token/README.md
+++ b/registry/coder/modules/vault-token/README.md
@@ -21,9 +21,9 @@ variable "vault_token" {
 
 module "vault" {
   source      = "registry.coder.com/coder/vault-token/coder"
-  version     = "1.0.7"
+  version     = "1.1.0"
   agent_id    = coder_agent.example.id
-  vault_token = var.token
+  vault_token = var.token # optional
   vault_addr  = "https://vault.example.com"
 }
 ```
@@ -74,10 +74,10 @@ variable "vault_token" {
 
 module "vault" {
   source            = "registry.coder.com/coder/vault-token/coder"
-  version           = "1.0.7"
+  version           = "1.1.0"
   agent_id          = coder_agent.example.id
   vault_addr        = "https://vault.example.com"
   vault_token       = var.token
-  vault_cli_version = "1.15.0"
+  vault_cli_version = "1.19.0"
 }
 ```
diff --git a/registry/coder/modules/vault-token/main.test.ts b/registry/coder/modules/vault-token/main.test.ts
index cf876ac..a163467 100644
--- a/registry/coder/modules/vault-token/main.test.ts
+++ b/registry/coder/modules/vault-token/main.test.ts
@@ -7,6 +7,5 @@ describe("vault-token", async () => {
   testRequiredVariables(import.meta.dir, {
     agent_id: "foo",
     vault_addr: "foo",
-    vault_token: "foo",
   });
 });
diff --git a/registry/coder/modules/vault-token/main.tf b/registry/coder/modules/vault-token/main.tf
index 94517d1..3461ba5 100644
--- a/registry/coder/modules/vault-token/main.tf
+++ b/registry/coder/modules/vault-token/main.tf
@@ -24,6 +24,7 @@ variable "vault_token" {
   type        = string
   description = "The Vault token to use for authentication."
   sensitive   = true
+  default     = null
 }
 
 variable "vault_cli_version" {
@@ -56,6 +57,7 @@ resource "coder_env" "vault_addr" {
 }
 
 resource "coder_env" "vault_token" {
+  count    = var.vault_token != null ? 1 : 0
   agent_id = var.agent_id
   name     = "VAULT_TOKEN"
   value    = var.vault_token