diff --git a/src/main/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecks.java b/src/main/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecks.java
index 55aec00..47bee06 100644
--- a/src/main/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecks.java
+++ b/src/main/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecks.java
@@ -65,7 +65,13 @@ public final class AuthentikHealthChecks
    public static void register(QInstance instance, AuthentikQBitConfig config)
    {
       HealthChecksMetaData registry = HealthChecksMetaData.ofOrWithNew(instance);
-      for(String name : List.of("api", "api_token", "mapper", "token_broker"))
+      /////////////////////////////////////////////////////////////////////////////////////////////////
+      // the token broker is only used when tokens are on; with tokens off a registered check        //
+      // could only ever report UNKNOWN "not configured", and core cannot remove a registered check. //
+      /////////////////////////////////////////////////////////////////////////////////////////////////
+      List<String> names = Boolean.TRUE.equals(config.getTokensEnabled())
+         ? List.of("api", "api_token", "mapper", "token_broker") : List.of("api", "api_token", "mapper");
+      for(String name : names)
       {
          registry.withCheck(new HealthCheckMetaData().withName("authentik." + name).withLabel("Authentik " + name)
             .withComponent("authentik").withCategory(HealthCategory.IDENTITY).withKind(HealthCheckKind.DEPENDENCY)
diff --git a/src/test/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecksTest.java b/src/test/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecksTest.java
index 9b43269..dda38d0 100644
--- a/src/test/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecksTest.java
+++ b/src/test/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecksTest.java
@@ -117,6 +117,33 @@ class AuthentikHealthChecksTest
 
 
 
+   /*******************************************************************************
+    ** With tokens off the token broker is not used, so no token_broker check is
+    ** registered (it could only ever show UNKNOWN "not configured"); the rest stay.
+    *******************************************************************************/
+   @Test
+   void registrationWithTokensOffOmitsTokenBroker() throws QException
+   {
+      QInstance tokensOff = AuthentikTestSupport.produce(AuthentikTestSupport.unitConfig().withApiToken(SECRET).withTokensEnabled(false));
+      var checks = HealthChecksMetaData.ofOrWithNew(tokensOff).resolveAll(tokensOff);
+      assertThat(checks).extracting(c -> c.getName()).containsExactly("authentik.api", "authentik.api_token", "authentik.mapper");
+   }
+
+
+
+   /*******************************************************************************
+    ** With tokens explicitly on the token broker check is registered as before.
+    *******************************************************************************/
+   @Test
+   void registrationWithTokensOnKeepsTokenBroker() throws QException
+   {
+      QInstance tokensOn = AuthentikTestSupport.produce(AuthentikTestSupport.unitConfig().withApiToken(SECRET).withTokensEnabled(true));
+      var checks = HealthChecksMetaData.ofOrWithNew(tokensOn).resolveAll(tokensOn);
+      assertThat(checks).extracting(c -> c.getName()).containsExactly("authentik.api", "authentik.api_token", "authentik.mapper", "authentik.token_broker");
+   }
+
+
+
    /*******************************************************************************
     ** Version responses are allowlisted before entering details.
     *******************************************************************************/