diff --git a/internal/listener/kubernetes/listener.go b/internal/listener/kubernetes/listener.go
index 1fc7d82..317a0d5 100644
--- a/internal/listener/kubernetes/listener.go
+++ b/internal/listener/kubernetes/listener.go
@@ -199,6 +199,10 @@ func (h *Handler[T]) fetchSecretKey(ctx context.Context, secretKeySelector *v1al
 }
 
 func (h *Handler[T]) serviceAccountToken(ctx context.Context, serviceAccountSelector *v1alpha1.ServiceAccountSelector) ([]byte, error) {
+	if h.CtrlClientSet == nil {
+		return nil, errors.New("controller client not initialized; creating account token is unavailable")
+	}
+
 	if serviceAccountSelector == nil {
 		return nil, errors.New("service account selector is nil")
 	}