diff --git a/docs/release-notes.d/luks-tang-thumbprint-guard.change.md b/docs/release-notes.d/luks-tang-thumbprint-guard.change.md
new file mode 100644
index 000000000..393ed404b
--- /dev/null
+++ b/docs/release-notes.d/luks-tang-thumbprint-guard.change.md
@@ -0,0 +1 @@
+Defensively guard against nil Tang thumbprint dereference when generating LUKS configuration
diff --git a/internal/exec/stages/disks/luks.go b/internal/exec/stages/disks/luks.go
index 037f5da8b..4dfe9fa82 100644
--- a/internal/exec/stages/disks/luks.go
+++ b/internal/exec/stages/disks/luks.go
@@ -330,9 +330,13 @@ func (s *stage) createLuks(config types.Config) error {
 								return fmt.Errorf("unmarshalling advertisement: %v", err)
 							}
 						}
+						thumbprint := ""
+						if tang.Thumbprint != nil {
+							thumbprint = *tang.Thumbprint
+						}
 						c.Pins.Tang = append(c.Pins.Tang, Tang{
 							URL:           tang.URL,
-							Thumbprint:    *tang.Thumbprint,
+							Thumbprint:    thumbprint,
 							Advertisement: adv,
 						})
 					}