diff --git a/pkg/handler/connect.go b/pkg/handler/connect.go
index 8ac40358..b94203df 100644
--- a/pkg/handler/connect.go
+++ b/pkg/handler/connect.go
@@ -756,7 +756,7 @@ func (c *ConnectOptions) getCIDR(ctx context.Context, m *dhcp.Manager) (err erro
 		}
 		if len(c.cidrs) != 0 {
 			log.Infoln("Got network CIDR from cache")
-			return
+			return nil
 		}
 	}
 
@@ -773,12 +773,12 @@ func (c *ConnectOptions) getCIDR(ctx context.Context, m *dhcp.Manager) (err erro
 		}
 		c.cidrs = util.RemoveLargerOverlappingCIDRs(append(c.cidrs, cidrs...))
 		_ = m.Set(ctx, config.KeyClusterIPv4POOLS, strings.Join(s.UnsortedList(), " "))
-		return
+		return nil
 	}
 
 	// (3) fallback to get cidr from node/pod/service
 	c.cidrs = util.GetCIDRFromResourceUgly(ctx, c.clientset, c.Namespace)
-	return
+	return nil
 }
 
 func (c *ConnectOptions) removeCIDRsContainingIPs(ipList []net.IP) {
@@ -950,6 +950,9 @@ func (c *ConnectOptions) upgradeDeploy(ctx context.Context) error {
 					continue
 				}
 			}
+			if len(spec.ImagePullSecrets) == 0 {
+				spec.ImagePullSecrets = nil
+			}
 			return nil
 		})
 	}
diff --git a/pkg/handler/remote.go b/pkg/handler/remote.go
index 0f05f683..0bcde1bf 100644
--- a/pkg/handler/remote.go
+++ b/pkg/handler/remote.go
@@ -481,13 +481,15 @@ kubevpn serve -L "tcp://:10800" -L "tun://:8422?net=${TunIPv4}" -L "gtcp://:1080
 						},
 					},
 					RestartPolicy: v1.RestartPolicyAlways,
-					ImagePullSecrets: []v1.LocalObjectReference{{
-						Name: imagePullSecretName,
-					}},
 				},
 			},
 		},
 	}
+	if imagePullSecretName != "" {
+		deploy.Spec.Template.Spec.ImagePullSecrets = []v1.LocalObjectReference{{
+			Name: imagePullSecretName,
+		}}
+	}
 	return deploy
 }