diff --git a/registry/coder/modules/vault-token/README.md b/registry/coder/modules/vault-token/README.md
index fada3fe..98f00ca 100644
--- a/registry/coder/modules/vault-token/README.md
+++ b/registry/coder/modules/vault-token/README.md
@@ -23,7 +23,7 @@ module "vault" {
   source      = "registry.coder.com/coder/vault-token/coder"
   version     = "1.0.7"
   agent_id    = coder_agent.example.id
-  vault_token = var.token
+  vault_token = var.token # optional
   vault_addr  = "https://vault.example.com"
 }
 ```
diff --git a/registry/coder/modules/vault-token/main.test.ts b/registry/coder/modules/vault-token/main.test.ts
index cf876ac..a163467 100644
--- a/registry/coder/modules/vault-token/main.test.ts
+++ b/registry/coder/modules/vault-token/main.test.ts
@@ -7,6 +7,5 @@ describe("vault-token", async () => {
   testRequiredVariables(import.meta.dir, {
     agent_id: "foo",
     vault_addr: "foo",
-    vault_token: "foo",
   });
 });
diff --git a/registry/coder/modules/vault-token/main.tf b/registry/coder/modules/vault-token/main.tf
index 94517d1..bcba5a1 100644
--- a/registry/coder/modules/vault-token/main.tf
+++ b/registry/coder/modules/vault-token/main.tf
@@ -24,6 +24,8 @@ variable "vault_token" {
   type        = string
   description = "The Vault token to use for authentication."
   sensitive   = true
+  default     = null
+
 }
 
 variable "vault_cli_version" {
@@ -56,6 +58,7 @@ resource "coder_env" "vault_addr" {
 }
 
 resource "coder_env" "vault_token" {
+  count    = var.vault_token != null ? 1 : 0
   agent_id = var.agent_id
   name     = "VAULT_TOKEN"
   value    = var.vault_token