diff --git a/auth/simple_token.go b/auth/simple_token.go
index a9dc5b715..41e922361 100644
--- a/auth/simple_token.go
+++ b/auth/simple_token.go
@@ -159,6 +159,11 @@ func (t *tokenSimple) invalidateUser(username string) {
 }
 
 func (t *tokenSimple) enable() {
+	t.simpleTokensMu.Lock()
+	defer t.simpleTokensMu.Unlock()
+	if t.simpleTokenKeeper != nil { // already enabled
+		return
+	}
 	if t.simpleTokenTTL <= 0 {
 		t.simpleTokenTTL = simpleTokenTTLDefault
 	}
diff --git a/auth/store.go b/auth/store.go
index ba1d95ff2..a1d2e077c 100644
--- a/auth/store.go
+++ b/auth/store.go
@@ -400,6 +400,9 @@ func (as *authStore) Recover(be backend.Backend) {
 
 	as.enabledMu.Lock()
 	as.enabled = enabled
+	if enabled {
+		as.tokenProvider.enable()
+	}
 	as.enabledMu.Unlock()
 }