diff --git a/agent/config/builder.go b/agent/config/builder.go
index 3dc12c463..4b9aab1b7 100644
--- a/agent/config/builder.go
+++ b/agent/config/builder.go
@@ -1078,10 +1078,8 @@ func (b *Builder) Build() (rt RuntimeConfig, err error) {
 		return RuntimeConfig{}, fmt.Errorf("cache.entry_fetch_rate must be strictly positive, was: %v", rt.Cache.EntryFetchRate)
 	}
 
-	if entCfg, err := b.BuildEnterpriseRuntimeConfig(&c); err != nil {
-		return RuntimeConfig{}, err
-	} else {
-		rt.EnterpriseRuntimeConfig = entCfg
+	if err := b.BuildEnterpriseRuntimeConfig(&rt, &c); err != nil {
+		return rt, err
 	}
 
 	if rt.BootstrapExpect == 1 {
@@ -1369,7 +1367,8 @@ func (b *Builder) Validate(rt RuntimeConfig) error {
 		b.warn(err.Error())
 	}
 
-	return nil
+	err := b.validateEnterpriseConfig(rt)
+	return err
 }
 
 // addrUnique checks if the given address is already in use for another
diff --git a/agent/config/builder_oss.go b/agent/config/builder_oss.go
index b585cab50..85cf08137 100644
--- a/agent/config/builder_oss.go
+++ b/agent/config/builder_oss.go
@@ -51,8 +51,12 @@ func (e enterpriseConfigKeyError) Error() string {
 	return fmt.Sprintf("%q is a Consul Enterprise configuration and will have no effect", e.key)
 }
 
-func (_ *Builder) BuildEnterpriseRuntimeConfig(_ *Config) (EnterpriseRuntimeConfig, error) {
-	return EnterpriseRuntimeConfig{}, nil
+func (*Builder) BuildEnterpriseRuntimeConfig(_ *RuntimeConfig, _ *Config) error {
+	return nil
+}
+
+func (*Builder) validateEnterpriseConfig(_ RuntimeConfig) error {
+	return nil
 }
 
 // validateEnterpriseConfig is a function to validate the enterprise specific
diff --git a/agent/config/runtime_oss_test.go b/agent/config/runtime_oss_test.go
index 3871940c5..b6eee07e2 100644
--- a/agent/config/runtime_oss_test.go
+++ b/agent/config/runtime_oss_test.go
@@ -6,11 +6,9 @@ var entMetaJSON = `{}`
 
 var entRuntimeConfigSanitize = `{}`
 
-var entFullDNSJSONConfig = ``
+var entTokenConfigSanitize = `"EnterpriseConfig": {},`
 
-var entFullDNSHCLConfig = ``
-
-var entFullRuntimeConfig = EnterpriseRuntimeConfig{}
+func entFullRuntimeConfig(rt *RuntimeConfig) {}
 
 var enterpriseNonVotingServerWarnings []string = []string{enterpriseConfigKeyError{key: "non_voting_server"}.Error()}
 
diff --git a/agent/config/runtime_test.go b/agent/config/runtime_test.go
index 48aafea6b..d56cce977 100644
--- a/agent/config/runtime_test.go
+++ b/agent/config/runtime_test.go
@@ -6497,9 +6497,10 @@ func TestFullConfig(t *testing.T) {
 				"args":       []interface{}{"dltjDJ2a", "flEa7C2d"},
 			},
 		},
-		EnterpriseRuntimeConfig: entFullRuntimeConfig,
 	}
 
+	entFullRuntimeConfig(&want)
+
 	warns := []string{
 		`The 'acl_datacenter' field is deprecated. Use the 'primary_datacenter' field instead.`,
 		`bootstrap_expect > 0: expecting 53 servers`,
@@ -6817,6 +6818,7 @@ func TestSanitize(t *testing.T) {
 
 	rtJSON := `{
 		"ACLTokens": {
+			` + entTokenConfigSanitize + `
 			"ACLAgentMasterToken": "hidden",
 			"ACLAgentToken": "hidden",
 			"ACLDefaultToken": "hidden",
diff --git a/agent/token/persistence.go b/agent/token/persistence.go
index 06861a40a..c36b90364 100644
--- a/agent/token/persistence.go
+++ b/agent/token/persistence.go
@@ -23,6 +23,8 @@ type Config struct {
 	ACLAgentToken       string
 	ACLAgentMasterToken string
 	ACLReplicationToken string
+
+	EnterpriseConfig
 }
 
 const tokensPath = "acl-tokens.json"
diff --git a/agent/token/store_oss.go b/agent/token/store_oss.go
index 97461edc2..16123052e 100644
--- a/agent/token/store_oss.go
+++ b/agent/token/store_oss.go
@@ -2,6 +2,9 @@
 
 package token
 
+type EnterpriseConfig struct {
+}
+
 // Stub for enterpriseTokens
 type enterpriseTokens struct {
 }