diff --git a/modules/workers/instanceconfig.tf b/modules/workers/instanceconfig.tf
index 0f420988..2115a31c 100644
--- a/modules/workers/instanceconfig.tf
+++ b/modules/workers/instanceconfig.tf
@@ -64,7 +64,7 @@ resource "oci_core_instance_configuration" "workers" {
           oke-native-pod-networking = var.cni_type == "npn" ? true : false
           oke-max-pods              = var.max_pods_per_node
           pod-subnets               = coalesce(var.pod_subnet_id, var.worker_subnet_id, "none")
-          pod-nsgids                = join(",", each.value.pod_nsg_ids)
+          pod-nsgids                = var.cni_type == "npn" ? join(",", each.value.pod_nsg_ids) : null
         },
 
         # Only provide cluster DNS service address if set explicitly; determined automatically in practice.