diff --git a/cmd/xmidt-agent/main.go b/cmd/xmidt-agent/main.go
index b8185f7..6bc7fb3 100644
--- a/cmd/xmidt-agent/main.go
+++ b/cmd/xmidt-agent/main.go
@@ -226,10 +226,14 @@ func onStart(cred *credentials.Credentials, ws *websocket.Websocket, qos *qos.Ha
 			return nil
 		}
 
-		ctx, cancel := context.WithTimeout(ctx, waitUntilFetched)
-		defer cancel()
-		// blocks until an attempt to fetch the credentials has been made or the context is canceled
-		cred.WaitUntilFetched(ctx)
+		// Allow operations where no credentials are desired (cred will be nil).
+		if cred != nil {
+			ctx, cancel := context.WithTimeout(ctx, waitUntilFetched)
+			defer cancel()
+			// blocks until an attempt to fetch the credentials has been made or the context is canceled
+			cred.WaitUntilFetched(ctx)
+		}
+
 		ws.Start()
 		qos.Start()
 
diff --git a/cmd/xmidt-agent/ws.go b/cmd/xmidt-agent/ws.go
index 4b501e7..9a85274 100644
--- a/cmd/xmidt-agent/ws.go
+++ b/cmd/xmidt-agent/ws.go
@@ -63,8 +63,14 @@ func provideWS(in wsIn) (wsOut, error) {
 		return wsOut{}, err
 	}
 
+	var opts []websocket.Option
+	// Allow operations where no credentials are desired (in.Cred will be nil).
+	if in.Cred != nil {
+		opts = append(opts, websocket.CredentialsDecorator(in.Cred.Decorate))
+	}
+
 	// Configuration options
-	opts := []websocket.Option{
+	opts = append(opts,
 		websocket.DeviceID(in.Identity.DeviceID),
 		websocket.FetchURLTimeout(in.Websocket.FetchURLTimeout),
 		websocket.FetchURL(
@@ -76,7 +82,6 @@ func provideWS(in wsIn) (wsOut, error) {
 		websocket.KeepAliveInterval(in.Websocket.KeepAliveInterval),
 		websocket.HTTPClient(client),
 		websocket.MaxMessageBytes(in.Websocket.MaxMessageBytes),
-		websocket.CredentialsDecorator(in.Cred.Decorate),
 		websocket.ConveyDecorator(in.Metadata.Decorate),
 		websocket.AdditionalHeaders(in.Websocket.AdditionalHeaders),
 		websocket.NowFunc(time.Now),
@@ -84,7 +89,7 @@ func provideWS(in wsIn) (wsOut, error) {
 		websocket.WithIPv4(!in.Websocket.DisableV4),
 		websocket.Once(in.Websocket.Once),
 		websocket.RetryPolicy(in.Websocket.RetryPolicy),
-	}
+	)
 
 	// Listener options
 	var (
diff --git a/internal/websocket/ws.go b/internal/websocket/ws.go
index 7cc47bf..f6380aa 100644
--- a/internal/websocket/ws.go
+++ b/internal/websocket/ws.go
@@ -225,7 +225,7 @@ func (ws *Websocket) run(ctx context.Context) {
 			Mode:    mode.ToEvent(),
 		}
 
-		// If auth fails, then continue with openfail xmidt connection
+		// If auth fails, then continue with no credentials.
 		ws.credDecorator(ws.additionalHeaders)
 
 		ws.conveyDecorator(ws.additionalHeaders)