diff --git a/operator/CHANGELOG.md b/operator/CHANGELOG.md
index 88627d13e837..71fd203b1d62 100644
--- a/operator/CHANGELOG.md
+++ b/operator/CHANGELOG.md
@@ -1,5 +1,7 @@
 ## Main
 
+- [7596](https://github.com/grafana/loki/pull/7596) **periklis**: Fix fresh-installs with built-in cert management enabled
+- [7064](https://github.com/grafana/loki/pull/7064) **periklis**: Add support for built-in cert management
 - [7471](https://github.com/grafana/loki/pull/7471) **aminesnow**: Expose and migrate query_timeout in limits config
 - [7437](https://github.com/grafana/loki/pull/7437) **aminesnow**: Fix Custom TLS profile setting for LokiStack on OpenShift
 - [7415](https://github.com/grafana/loki/pull/7415) **aminesnow**: Add alert relabel config
diff --git a/operator/internal/handlers/internal/certificates/options.go b/operator/internal/handlers/internal/certificates/options.go
index 017f3f372d1a..ae3695648730 100644
--- a/operator/internal/handlers/internal/certificates/options.go
+++ b/operator/internal/handlers/internal/certificates/options.go
@@ -113,6 +113,10 @@ func configureCertificatesForTenantMode(certs certrotation.ComponentCertificates
 }
 
 func configureCABundleForTenantMode(cm *corev1.ConfigMap, mode lokiv1.ModeType) {
+	if cm == nil {
+		return
+	}
+
 	switch mode {
 	case "", lokiv1.Dynamic, lokiv1.Static:
 		return