diff --git a/pkg/config/template.go b/pkg/config/template.go
index e32ab3ff4a3..ba3ff1f9004 100644
--- a/pkg/config/template.go
+++ b/pkg/config/template.go
@@ -1172,9 +1172,9 @@ const templateStringCrioRuntimeWorkloads = `# The workloads table defines ways t
 {{ $.Comment }}[crio.runtime.workloads.{{ $workload_type }}]
 {{ $.Comment }}activation_annotation = "{{ $workload_config.ActivationAnnotation }}"
 {{ $.Comment }}annotation_prefix = "{{ $workload_config.AnnotationPrefix }}"
-{{ $.Comment }}[crio.runtime.workloads.{{ $workload_type }}.resources]
+{{ if $workload_config.Resources }}{{ $.Comment }}[crio.runtime.workloads.{{ $workload_type }}.resources]
 {{ $.Comment }}cpuset = "{{ $workload_config.Resources.CPUSet }}"
-{{ $.Comment }}cpushares = {{ $workload_config.Resources.CPUShares }}
+{{ $.Comment }}cpushares = {{ $workload_config.Resources.CPUShares }}{{ end }}
 {{ end }}
 `
 
diff --git a/test/config.bats b/test/config.bats
index f5e387a6423..c51252930e1 100644
--- a/test/config.bats
+++ b/test/config.bats
@@ -96,3 +96,16 @@ EOF
 	[[ "$RES" == *"monitor_cgroup = \"pod\""* ]]
 	[[ "$RES" == *"monitor_path = \"/bin/true\""* ]]
 }
+
+@test "handle nil workloads" {
+	# when
+	unset CONTAINER_DEFAULT_RUNTIME
+	cat << EOF >> "$TESTDIR"/workload.conf
+[crio.runtime.workloads.userns]
+activation_annotation = "io.kubernetes.cri-o.userns-mode"
+allowed_annotations = ["io.kubernetes.cri-o.userns-mode"]
+EOF
+
+	# then
+	"$CRIO_BINARY_PATH" -c "$TESTDIR"/workload.conf -d "" config
+}