diff --git a/internal/provider/bootstrap.go b/internal/provider/bootstrap.go
index 6389a47..498dc42 100644
--- a/internal/provider/bootstrap.go
+++ b/internal/provider/bootstrap.go
@@ -49,7 +49,7 @@ func Bootstrap(e *pluggable.Event) pluggable.EventResponse {
 	// TODO: this belong to a systemd service that is started instead
 
 	kairosBlockisDefined := providerConfig.Kairos != nil
-	tokenNotDefined := (kairosBlockisDefined && providerConfig.Kairos.NetworkToken == "")
+	tokenNotDefined := ((kairosBlockisDefined && providerConfig.Kairos.NetworkToken == "") || !kairosBlockisDefined)
 	skipAuto := (kairosBlockisDefined && providerConfig.Kairos.SkipAuto)
 
 	if providerConfig.Kairos == nil && !providerConfig.K3s.Enabled && !providerConfig.K3sAgent.Enabled {
diff --git a/internal/provider/p2p.go b/internal/provider/p2p.go
index 7a7f91c..de566b7 100644
--- a/internal/provider/p2p.go
+++ b/internal/provider/p2p.go
@@ -77,9 +77,9 @@ func SetupAPI(apiAddress, rootDir string, start bool, c *providerConfig.Config)
 }
 
 func SetupVPN(instance, apiAddress, rootDir string, start bool, c *providerConfig.Config) error {
-
-	if c.Kairos == nil || c.Kairos.NetworkToken == "" {
-		return fmt.Errorf("no network token defined")
+	token := ""
+	if c.Kairos != nil && c.Kairos.NetworkToken != "" {
+		token = c.Kairos.NetworkToken
 	}
 
 	svc, err := services.EdgeVPN(instance, rootDir)
@@ -91,12 +91,14 @@ func SetupVPN(instance, apiAddress, rootDir string, start bool, c *providerConfi
 	apiAddress = strings.ReplaceAll(apiAddress, "http://", "")
 
 	vpnOpts := map[string]string{
-		"EDGEVPNTOKEN": c.Kairos.NetworkToken,
 		"API":          "true",
 		"APILISTEN":    apiAddress,
 		"DHCP":         "true",
 		"DHCPLEASEDIR": "/usr/local/.kairos/lease",
 	}
+	if token != "" {
+		vpnOpts["EDGEVPNTOKEN"] = c.Kairos.NetworkToken
+	}
 	// Override opts with user-supplied
 	for k, v := range c.VPN {
 		vpnOpts[k] = v