diff --git a/pkg/kubelet/images/image_manager.go b/pkg/kubelet/images/image_manager.go
index eb543fb0583..f52297c3ec6 100644
--- a/pkg/kubelet/images/image_manager.go
+++ b/pkg/kubelet/images/image_manager.go
@@ -178,6 +178,12 @@ func (m *imageManager) EnsureImageExists(ctx context.Context, objRef *v1.ObjectR
 		return "", message, err
 	}
 
+	if imageRef != "" && !utilfeature.DefaultFeatureGate.Enabled(features.KubeletEnsureSecretPulledImages) {
+		msg := fmt.Sprintf("Container image %q already present on machine", requestedImage)
+		m.logIt(objRef, v1.EventTypeNormal, events.PulledImage, logPrefix, msg, klog.Info)
+		return imageRef, msg, nil
+	}
+
 	repoToPull, _, _, err := parsers.ParseImageName(spec.Image)
 	if err != nil {
 		return "", err.Error(), err
@@ -207,12 +213,6 @@ func (m *imageManager) EnsureImageExists(ctx context.Context, objRef *v1.ObjectR
 	pullCredentials, _ := keyring.Lookup(repoToPull)
 
 	if imageRef != "" {
-		if !utilfeature.DefaultFeatureGate.Enabled(features.KubeletEnsureSecretPulledImages) {
-			msg := fmt.Sprintf("Container image %q already present on machine", requestedImage)
-			m.logIt(objRef, v1.EventTypeNormal, events.PulledImage, logPrefix, msg, klog.Info)
-			return imageRef, msg, nil
-		}
-
 		var imagePullSecrets []kubeletconfiginternal.ImagePullSecret
 		// we don't take the audience of the service account into account, so there can only
 		// be one imagePullServiceAccount per pod when we try to make a decision.