diff --git a/internal/app/machined/pkg/controllers/secrets/root.go b/internal/app/machined/pkg/controllers/secrets/root.go
index ac7d4c5a11..230f0d332a 100644
--- a/internal/app/machined/pkg/controllers/secrets/root.go
+++ b/internal/app/machined/pkg/controllers/secrets/root.go
@@ -165,11 +165,11 @@ func NewRootOSController() *RootOSController {
 					osSecrets.AcceptedCAs = append(osSecrets.AcceptedCAs, &x509.PEMEncodedCertificate{
 						Crt: osSecrets.IssuingCA.Crt,
 					})
-				}
 
-				if len(osSecrets.IssuingCA.Key) == 0 {
-					// drop incomplete issuing CA, as the machine config for workers contains just the cert
-					osSecrets.IssuingCA = nil
+					if len(osSecrets.IssuingCA.Key) == 0 {
+						// drop incomplete issuing CA, as the machine config for workers contains just the cert
+						osSecrets.IssuingCA = nil
+					}
 				}
 
 				osSecrets.CertSANIPs = nil