diff --git a/pkg/operator/deploy/deploy.go b/pkg/operator/deploy/deploy.go
index 7e5f84a63..94135518e 100644
--- a/pkg/operator/deploy/deploy.go
+++ b/pkg/operator/deploy/deploy.go
@@ -542,6 +542,10 @@ func (o *operator) EnsureUpgradeAnnotation(ctx context.Context) error {
 		return nil
 	}
 
+	if o.oc.Properties.PlatformWorkloadIdentityProfile.UpgradeableTo == nil {
+		return nil
+	}
+
 	upgradeableTo := string(*o.oc.Properties.PlatformWorkloadIdentityProfile.UpgradeableTo)
 	upgradeableAnnotation := "cloudcredential.openshift.io/upgradeable-to"
 
diff --git a/pkg/operator/deploy/deploy_test.go b/pkg/operator/deploy/deploy_test.go
index b41e4ab7b..d4852a116 100644
--- a/pkg/operator/deploy/deploy_test.go
+++ b/pkg/operator/deploy/deploy_test.go
@@ -504,7 +504,7 @@ func TestCheckPodImageVersion(t *testing.T) {
 	}
 }
 
-func TestTestEnsureUpgradeAnnotation(t *testing.T) {
+func TestEnsureUpgradeAnnotation(t *testing.T) {
 	UpgradeableTo1 := api.UpgradeableTo("4.14.59")
 
 	for _, tt := range []struct {
@@ -528,6 +528,14 @@ func TestTestEnsureUpgradeAnnotation(t *testing.T) {
 				PlatformWorkloadIdentityProfile: &api.PlatformWorkloadIdentityProfile{},
 			},
 		},
+		{
+			name: "upgradeableto not set",
+			cluster: api.OpenShiftClusterProperties{
+				PlatformWorkloadIdentityProfile: &api.PlatformWorkloadIdentityProfile{
+					UpgradeableTo: nil,
+				},
+			},
+		},
 		{
 			name: "no version persisted in cluster document, persist it",
 			cluster: api.OpenShiftClusterProperties{