diff --git a/plugins/kubernetes-backend/src/service/KubernetesFetcher.test.ts b/plugins/kubernetes-backend/src/service/KubernetesFetcher.test.ts
index 9a1833cc4c..2311dacdc3 100644
--- a/plugins/kubernetes-backend/src/service/KubernetesFetcher.test.ts
+++ b/plugins/kubernetes-backend/src/service/KubernetesFetcher.test.ts
@@ -754,6 +754,24 @@ describe('KubernetesFetcher', () => {
         ],
       });
     });
+    describe('Backstage not running on k8s', () => {
+      it('fails if cluster details has no token', () => {
+        const result = sut.fetchObjectsForService({
+          serviceId: 'some-service',
+          clusterDetails: {
+            name: 'unauthenticated-cluster',
+            url: 'http://ignored',
+            authProvider: 'serviceAccount',
+          },
+          objectTypesToFetch: OBJECTS_TO_FETCH,
+          labelSelector: '',
+          customResources: [],
+        });
+        return expect(result).rejects.toThrow(
+          "no bearer token for cluster 'unauthenticated-cluster' and not running in Kubernetes",
+        );
+      });
+    });
     describe('Backstage running on k8s', () => {
       const initialHost = process.env.KUBERNETES_SERVICE_HOST;
       const initialPort = process.env.KUBERNETES_SERVICE_PORT;
diff --git a/plugins/kubernetes-backend/src/service/KubernetesFetcher.ts b/plugins/kubernetes-backend/src/service/KubernetesFetcher.ts
index f90b96644d..b700c74e4c 100644
--- a/plugins/kubernetes-backend/src/service/KubernetesFetcher.ts
+++ b/plugins/kubernetes-backend/src/service/KubernetesFetcher.ts
@@ -15,6 +15,7 @@
  */
 
 import {
+  Config,
   Cluster,
   CoreV1Api,
   KubeConfig,
@@ -187,10 +188,19 @@ export class KubernetesClientBasedFetcher implements KubernetesFetcher {
     }
     resourcePath += `/${encode(plural)}`;
 
-    const [url, requestInit]: [URL, RequestInit] =
-      clusterDetails.serviceAccountToken
-        ? this.fetchArgsFromClusterDetails(clusterDetails)
-        : this.fetchArgsInCluster();
+    let url: URL;
+    let requestInit: RequestInit;
+    if (clusterDetails.serviceAccountToken) {
+      [url, requestInit] = this.fetchArgsFromClusterDetails(clusterDetails);
+    } else if (fs.pathExistsSync(Config.SERVICEACCOUNT_TOKEN_PATH)) {
+      [url, requestInit] = this.fetchArgsInCluster();
+    } else {
+      return Promise.reject(
+        new Error(
+          `no bearer token for cluster '${clusterDetails.name}' and not running in Kubernetes`,
+        ),
+      );
+    }
 
     url.pathname = resourcePath;
     if (labelSelector) {