diff --git a/vault-token/main.test.ts b/vault-token/main.test.ts
index d5134252..91ad50b5 100644
--- a/vault-token/main.test.ts
+++ b/vault-token/main.test.ts
@@ -7,6 +7,5 @@ describe("vault-token", async () => {
   testRequiredVariables(import.meta.dir, {
     agent_id: "foo",
     vault_addr: "foo",
-    vault_token: "foo",
   });
 });
diff --git a/vault-token/main.tf b/vault-token/main.tf
index 94517d10..3461ba56 100644
--- a/vault-token/main.tf
+++ b/vault-token/main.tf
@@ -24,6 +24,7 @@ variable "vault_token" {
   type        = string
   description = "The Vault token to use for authentication."
   sensitive   = true
+  default     = null
 }
 
 variable "vault_cli_version" {
@@ -56,6 +57,7 @@ resource "coder_env" "vault_addr" {
 }
 
 resource "coder_env" "vault_token" {
+  count    = var.vault_token != null ? 1 : 0
   agent_id = var.agent_id
   name     = "VAULT_TOKEN"
   value    = var.vault_token