diff --git a/src/core/config/mod.rs b/src/core/config/mod.rs
index 7e0b2122..89d48c6e 100644
--- a/src/core/config/mod.rs
+++ b/src/core/config/mod.rs
@@ -1806,6 +1806,7 @@ pub struct Config {
 	pub blurhashing: BlurhashConfig,
 
 	// external structure; separate section
+	#[serde(default)]
 	pub ldap: LdapConfig,
 
 	#[serde(flatten)]
@@ -1889,7 +1890,7 @@ pub struct BlurhashConfig {
 	pub blurhash_max_raw_size: u64,
 }
 
-#[derive(Clone, Debug, Deserialize)]
+#[derive(Clone, Debug, Default, Deserialize)]
 #[config_example_generator(filename = "tuwunel-example.toml", section = "global.ldap")]
 pub struct LdapConfig {
 	/// Whether to enable LDAP login.
@@ -1901,8 +1902,7 @@ pub struct LdapConfig {
 	/// URI of the LDAP server.
 	///
 	/// example: "ldap://ldap.example.com:389"
-	#[serde(deserialize_with = "crate::utils::deserialize_from_str")]
-	pub uri: Url,
+	pub uri: Option<Url>,
 
 	/// Root of the searches.
 	///
diff --git a/src/service/users/mod.rs b/src/service/users/mod.rs
index 7410c6a8..7b8f1c6a 100644
--- a/src/service/users/mod.rs
+++ b/src/service/users/mod.rs
@@ -1185,7 +1185,13 @@ impl Service {
 		use tuwunel_core::{debug, error, result::LogErr};
 
 		let config = &self.services.server.config.ldap;
-		let (conn, mut ldap) = LdapConnAsync::new(config.uri.as_str())
+		let uri = config
+			.uri
+			.as_ref()
+			.ok_or_else(|| err!(Ldap(error!("LDAP URI is not configured."))))?;
+
+		debug!(?uri, "LDAP creating connection...");
+		let (conn, mut ldap) = LdapConnAsync::new(uri.as_str())
 			.await
 			.map_err(|e| err!(Ldap(error!(?user_id, "LDAP connection setup error: {e}"))))?;
 
@@ -1255,7 +1261,13 @@ impl Service {
 		use tuwunel_core::{debug, error, result::LogErr};
 
 		let config = &self.services.server.config.ldap;
-		let (conn, mut ldap) = LdapConnAsync::new(config.uri.as_str())
+		let uri = config
+			.uri
+			.as_ref()
+			.ok_or_else(|| err!(Ldap(error!("LDAP URI is not configured."))))?;
+
+		debug!(?uri, "LDAP creating connection...");
+		let (conn, mut ldap) = LdapConnAsync::new(uri.as_str())
 			.await
 			.map_err(|e| err!(Ldap(error!(?user_dn, "LDAP connection setup error: {e}"))))?;