diff --git a/pkg/webhook/controlplane/ensurer.go b/pkg/webhook/controlplane/ensurer.go
index a1fc794f8..c56183540 100644
--- a/pkg/webhook/controlplane/ensurer.go
+++ b/pkg/webhook/controlplane/ensurer.go
@@ -667,25 +667,25 @@ func (c *controlPlaneMutator) Mutate(ctx context.Context, new, old client.Object
 		if greaterEqual122 {
 			switch x.Name {
 			case cluster.Shoot.Name:
+				config := &awsv1alpha1.ControlPlaneConfig{
+					TypeMeta: metav1.TypeMeta{
+						APIVersion: awsv1alpha1.SchemeGroupVersion.String(),
+						Kind:       "ControlPlaneConfig",
+					},
+				}
 				if x.Spec.ProviderConfig != nil && x.Spec.ProviderConfig.Raw != nil {
-					config := &awsv1alpha1.ControlPlaneConfig{
-						TypeMeta: metav1.TypeMeta{
-							APIVersion: awsv1alpha1.SchemeGroupVersion.String(),
-							Kind:       "ControlPlaneConfig",
-						},
-					}
 					if _, _, err := decoder.Decode(x.Spec.ProviderConfig.Raw, nil, config); err != nil {
 						return err
 					}
-					if config.CloudControllerManager == nil {
-						config.CloudControllerManager = &awsv1alpha1.CloudControllerManagerConfig{}
-					}
-					if config.CloudControllerManager.UseCustomRouteController == nil {
-						extensionswebhook.LogMutation(c.logger, x.Kind, x.Namespace, x.Name)
-						config.CloudControllerManager.UseCustomRouteController = pointer.Bool(true)
-						x.Spec.ProviderConfig = &runtime.RawExtension{
-							Object: config,
-						}
+				}
+				if config.CloudControllerManager == nil {
+					config.CloudControllerManager = &awsv1alpha1.CloudControllerManagerConfig{}
+				}
+				if config.CloudControllerManager.UseCustomRouteController == nil {
+					extensionswebhook.LogMutation(c.logger, x.Kind, x.Namespace, x.Name)
+					config.CloudControllerManager.UseCustomRouteController = pointer.Bool(true)
+					x.Spec.ProviderConfig = &runtime.RawExtension{
+						Object: config,
 					}
 				}
 			}
diff --git a/pkg/webhook/controlplane/ensurer_test.go b/pkg/webhook/controlplane/ensurer_test.go
index b66acf80b..e000381ad 100644
--- a/pkg/webhook/controlplane/ensurer_test.go
+++ b/pkg/webhook/controlplane/ensurer_test.go
@@ -838,6 +838,20 @@ done
 			Expect(*controlPlane.Spec.ProviderConfig.Object.(*awsv1alpha1.ControlPlaneConfig).CloudControllerManager.UseCustomRouteController).To(BeTrue())
 		})
 
+		It("should enable for kubernetes >= 1.22 without provider config", func() {
+			controlPlane.Spec.DefaultSpec = extensionsv1alpha1.DefaultSpec{}
+			oldControlPlane := controlPlane.DeepCopy()
+
+			client.EXPECT().Get(ctx, clusterKey, &extensionsv1alpha1.Cluster{}).DoAndReturn(clientGet(newCluster))
+
+			err := mutator.Mutate(ctx, controlPlane, nil)
+			Expect(err).To(Not(HaveOccurred()))
+			Expect(oldControlPlane).To(Not(Equal(controlPlane)))
+			Expect(controlPlane.Spec.ProviderConfig.Object).ToNot(BeNil())
+			Expect(*controlPlane.Spec.ProviderConfig.Object.(*awsv1alpha1.ControlPlaneConfig).CloudControllerManager).ToNot(BeNil())
+			Expect(*controlPlane.Spec.ProviderConfig.Object.(*awsv1alpha1.ControlPlaneConfig).CloudControllerManager.UseCustomRouteController).To(BeTrue())
+		})
+
 		It("should not enable on update", func() {
 			oldControlPlane := controlPlane.DeepCopy()