diff --git a/server/auth/simple_token.go b/server/auth/simple_token.go
index 7b1b094ae..be706522a 100644
--- a/server/auth/simple_token.go
+++ b/server/auth/simple_token.go
@@ -156,6 +156,11 @@ func (t *tokenSimple) invalidateUser(username string) {
 }
 
 func (t *tokenSimple) enable() {
+	t.simpleTokensMu.Lock()
+	defer t.simpleTokensMu.Unlock()
+	if t.simpleTokenKeeper != nil { // already enabled
+		return
+	}
 	if t.simpleTokenTTL <= 0 {
 		t.simpleTokenTTL = simpleTokenTTLDefault
 	}
diff --git a/server/auth/store.go b/server/auth/store.go
index 09d9cdc67..749eae478 100644
--- a/server/auth/store.go
+++ b/server/auth/store.go
@@ -368,6 +368,9 @@ func (as *authStore) Recover(be backend.Backend) {
 
 	as.enabledMu.Lock()
 	as.enabled = enabled
+	if enabled {
+		as.tokenProvider.enable()
+	}
 	as.enabledMu.Unlock()
 }