diff --git a/controllers/k8ssandra/reaper.go b/controllers/k8ssandra/reaper.go
index bd6196eef..4145de48b 100644
--- a/controllers/k8ssandra/reaper.go
+++ b/controllers/k8ssandra/reaper.go
@@ -29,7 +29,6 @@ import (
 	k8ssandralabels "github.com/k8ssandra/k8ssandra-operator/pkg/labels"
 	"github.com/k8ssandra/k8ssandra-operator/pkg/reaper"
 	"github.com/k8ssandra/k8ssandra-operator/pkg/result"
-	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/types"
@@ -106,9 +105,6 @@ func (r *K8ssandraClusterReconciler) reconcileReaper(
 		logger.Info("Reaper present for DC " + actualDc.DatacenterName())
 
 		desiredReaper, err := reaper.NewReaper(reaperKey, kc, actualDc, reaperTemplate, logger)
-		if kc.Spec.Reaper.UiUserSecretRef == nil {
-			desiredReaper.Spec.UiUserSecretRef = &corev1.LocalObjectReference{Name: reaper.DefaultUiSecretName(kc.SanitizedName())}
-		}
 
 		if err != nil {
 			logger.Error(err, "failed to create Reaper API object")
diff --git a/pkg/reaper/resource.go b/pkg/reaper/resource.go
index 4ecc8ca64..a12170a93 100644
--- a/pkg/reaper/resource.go
+++ b/pkg/reaper/resource.go
@@ -70,8 +70,10 @@ func NewReaper(
 			desiredReaper.Spec.CassandraUserSecretRef.Name = DefaultUserSecretName(kc.SanitizedName())
 		}
 		// Note: deliberately skip JmxUserSecretRef, which is deprecated.
-		if desiredReaper.Spec.UiUserSecretRef == nil {
+		if kc.Spec.Reaper.UiUserSecretRef == nil && kc.Spec.IsAuthEnabled() {
 			desiredReaper.Spec.UiUserSecretRef = &corev1.LocalObjectReference{Name: DefaultUiSecretName(kc.SanitizedName())}
+		} else {
+			desiredReaper.Spec.UiUserSecretRef = nil
 		}
 
 		if desiredReaper.Spec.ResourceMeta == nil {