diff --git a/agent/consul/client.go b/agent/consul/client.go
index bcaf5aac19..66acc45446 100644
--- a/agent/consul/client.go
+++ b/agent/consul/client.go
@@ -181,10 +181,6 @@ func NewClientLogger(config *Config, logger hclog.InterceptLogger, tlsConfigurat
 		return nil, fmt.Errorf("Failed to start lan serf: %v", err)
 	}
 
-	if c.acls.ACLsEnabled() {
-		go c.monitorACLMode()
-	}
-
 	// Start maintenance task for servers
 	c.routers = router.New(c.logger, c.shutdownCh, c.serf, c.connPool, "")
 	go c.routers.Start()
@@ -193,6 +189,12 @@ func NewClientLogger(config *Config, logger hclog.InterceptLogger, tlsConfigurat
 	// handlers depend on the router and the router depends on Serf.
 	go c.lanEventHandler()
 
+	// This needs to happen after initializing c.routers to prevent a race
+	// condition where the router manager is used when the pointer is nil
+	if c.acls.ACLsEnabled() {
+		go c.monitorACLMode()
+	}
+
 	if err := c.startEnterprise(); err != nil {
 		c.Shutdown()
 		return nil, err
diff --git a/agent/router/manager.go b/agent/router/manager.go
index 7944e48d26..0940ee2367 100644
--- a/agent/router/manager.go
+++ b/agent/router/manager.go
@@ -235,6 +235,10 @@ func (m *Manager) FindServer() *metadata.Server {
 }
 
 func (m *Manager) checkServers(fn func(srv *metadata.Server) bool) bool {
+	if m == nil {
+		return true
+	}
+
 	for _, srv := range m.getServerList().servers {
 		if !fn(srv) {
 			return false