diff --git a/controllers/kubeadmconfig_controller.go b/controllers/kubeadmconfig_controller.go
index d8e3220..d64ef01 100644
--- a/controllers/kubeadmconfig_controller.go
+++ b/controllers/kubeadmconfig_controller.go
@@ -148,7 +148,7 @@ func (r *KubeadmConfigReconciler) Reconcile(req ctrl.Request) (_ ctrl.Result, re
 		err = patchHelper.Patch(ctx, config)
 		return ctrl.Result{}, err
 	// If we've already embedded a time-limited join token into a config, but are still waiting for the token to be used, refresh it
-	case config.Status.Ready:
+	case config.Status.Ready && (config.Spec.JoinConfiguration != nil && config.Spec.JoinConfiguration.Discovery.BootstrapToken != nil):
 		token := config.Spec.JoinConfiguration.Discovery.BootstrapToken.Token
 
 		// gets the remote secret interface client for the current cluster
diff --git a/controllers/kubeadmconfig_controller_test.go b/controllers/kubeadmconfig_controller_test.go
index a8ff120..ebd7111 100644
--- a/controllers/kubeadmconfig_controller_test.go
+++ b/controllers/kubeadmconfig_controller_test.go
@@ -398,7 +398,13 @@ func TestKubeadmConfigReconciler_Reconcile_GenerateCloudConfigData(t *testing.T)
 		t.Fatal("Expected status ready")
 	}
 	if cfg.Status.BootstrapData == nil {
-		t.Fatal("Expected status ready")
+		t.Fatal("Expected generated bootstrap data")
+	}
+
+	// Ensure that we don't fail trying to refresh any bootstrap tokens
+	_, err = k.Reconcile(request)
+	if err != nil {
+		t.Fatalf("Failed to reconcile:\n %+v", err)
 	}
 }