diff --git a/internal/tlsutil/cfg.go b/internal/tlsutil/cfg.go
index 8b9d4329f..04aa907d3 100644
--- a/internal/tlsutil/cfg.go
+++ b/internal/tlsutil/cfg.go
@@ -53,6 +53,12 @@ func ClientConfig(opts Options) (cfg *tls.Config, err error) {
 		}
 	}
 
-	cfg = &tls.Config{InsecureSkipVerify: opts.InsecureSkipVerify, Certificates: []tls.Certificate{*cert}, RootCAs: pool}
+	cfg = &tls.Config{
+		InsecureSkipVerify: opts.InsecureSkipVerify,
+		RootCAs:            pool,
+	}
+	if cert != nil {
+		cfg.Certificates = []tls.Certificate{*cert}
+	}
 	return cfg, nil
 }
diff --git a/internal/tlsutil/tlsutil_test.go b/internal/tlsutil/tlsutil_test.go
index e31a873d3..7236a6b4e 100644
--- a/internal/tlsutil/tlsutil_test.go
+++ b/internal/tlsutil/tlsutil_test.go
@@ -112,3 +112,22 @@ func TestNewClientTLS(t *testing.T) {
 		t.Fatalf("mismatch tls RootCAs, expecting nil")
 	}
 }
+
+func TestClientConfigWithoutClientCert(t *testing.T) {
+	opts := Options{
+		InsecureSkipVerify: true,
+	}
+
+	cfg, err := ClientConfig(opts)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if cfg == nil {
+		t.Fatal("expected non-nil tls.Config")
+	}
+
+	if len(cfg.Certificates) != 0 {
+		t.Fatalf("expected empty Certificates slice, got %d", len(cfg.Certificates))
+	}
+}