diff --git a/cmd/zrok/adminBootstrap.go b/cmd/zrok/adminBootstrap.go
index bdeab71d..0781243e 100644
--- a/cmd/zrok/adminBootstrap.go
+++ b/cmd/zrok/adminBootstrap.go
@@ -13,8 +13,9 @@ func init() {
 }
 
 type adminBootstrap struct {
-	cmd          *cobra.Command
-	skipFrontend bool
+	cmd                 *cobra.Command
+	skipFrontend        bool
+	skipSecretsListener bool
 }
 
 func newAdminBootstrap() *adminBootstrap {
@@ -26,6 +27,7 @@ func newAdminBootstrap() *adminBootstrap {
 	command := &adminBootstrap{cmd: cmd}
 	cmd.Run = command.run
 	cmd.Flags().BoolVar(&command.skipFrontend, "skip-frontend", false, "Skip frontend identity bootstrapping")
+	cmd.Flags().BoolVar(&command.skipSecretsListener, "skip-secrets-listener", false, "Skip secrets listener bootstrapping")
 	return command
 }
 
@@ -36,7 +38,11 @@ func (cmd *adminBootstrap) run(_ *cobra.Command, args []string) {
 		panic(err)
 	}
 	logrus.Info(cf.Dump(inCfg, cf.DefaultOptions()))
-	if err := controller.Bootstrap(cmd.skipFrontend, inCfg); err != nil {
+	bootCfg := &controller.BootstrapConfig{
+		SkipFrontend:        cmd.skipFrontend,
+		SkipSecretsListener: cmd.skipSecretsListener,
+	}
+	if err := controller.Bootstrap(bootCfg, inCfg); err != nil {
 		panic(err)
 	}
 	logrus.Info("bootstrap complete!")
diff --git a/controller/bootstrap.go b/controller/bootstrap.go
index bce4d8fd..3ed82435 100644
--- a/controller/bootstrap.go
+++ b/controller/bootstrap.go
@@ -5,6 +5,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"time"
+
 	"github.com/openziti/edge-api/rest_management_api_client"
 	restMgmtEdgeConfig "github.com/openziti/edge-api/rest_management_api_client/config"
 	"github.com/openziti/edge-api/rest_management_api_client/edge_router_policy"
@@ -16,23 +18,26 @@ import (
 	"github.com/openziti/zrok/controller/store"
 	"github.com/openziti/zrok/controller/zrokEdgeSdk"
 	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/environment/env_core"
 	"github.com/openziti/zrok/sdk/golang/sdk"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"time"
 )
 
-func Bootstrap(skipFrontend bool, inCfg *config.Config) error {
-	cfg = inCfg
+type BootstrapConfig struct {
+	SkipFrontend        bool
+	SkipSecretsListener bool
+}
 
-	if v, err := store.Open(cfg.Store); err == nil {
+func Bootstrap(bootCfg *BootstrapConfig, ctrlCfg *config.Config) error {
+	if v, err := store.Open(ctrlCfg.Store); err == nil {
 		str = v
 	} else {
 		return errors.Wrap(err, "error opening store")
 	}
 
 	logrus.Info("connecting to the ziti edge management api")
-	edge, err := zrokEdgeSdk.Client(cfg.Ziti)
+	edge, err := zrokEdgeSdk.Client(ctrlCfg.Ziti)
 	if err != nil {
 		return errors.Wrap(err, "error connecting to the ziti edge management api")
 	}
@@ -42,17 +47,30 @@ func Bootstrap(skipFrontend bool, inCfg *config.Config) error {
 		return err
 	}
 
+	if err := assertFrontendIdentity(bootCfg, env, edge); err != nil {
+		return err
+	}
+
+	if err := assertZrokProxyConfigType(edge); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func assertFrontendIdentity(cfg *BootstrapConfig, env env_core.Root, edge *rest_management_api_client.ZitiEdgeManagement) error {
 	var frontendZId string
-	if !skipFrontend {
+	if !cfg.SkipFrontend {
 		logrus.Info("creating identity for public frontend access")
 
-		if frontendZId, err = getIdentityId(env.PublicIdentityName()); err == nil {
+		if frontendZId, err := getIdentityId(env.PublicIdentityName()); err == nil {
 			logrus.Infof("frontend identity: %v", frontendZId)
 		} else {
 			frontendZId, err = bootstrapIdentity(env.PublicIdentityName(), edge)
 			if err != nil {
 				panic(err)
 			}
+			logrus.Infof("created frontend identity (%v) '%v'", env.PublicIdentityName(), frontendZId)
 		}
 		if err := assertIdentity(frontendZId, edge); err != nil {
 			panic(err)
@@ -76,12 +94,9 @@ func Bootstrap(skipFrontend bool, inCfg *config.Config) error {
 				logrus.Warnf("found frontend entry for ziti identity '%v'; missing either public name or url template", frontendZId)
 			}
 		}
+	} else {
+		logrus.Warnf("skipping frontend identity bootstrap")
 	}
-
-	if err := assertZrokProxyConfigType(edge); err != nil {
-		return err
-	}
-
 	return nil
 }