diff --git a/controllers/validator.go b/controllers/validator.go
index 66a4ce316d..7630b68fca 100644
--- a/controllers/validator.go
+++ b/controllers/validator.go
@@ -22,6 +22,10 @@ func (r *DPAReconciler) ValidateDataProtectionCR(log logr.Logger) (bool, error)
 		return false, errors.New("no backupstoragelocations configured, ensure a backupstoragelocation has been configured or use the noDefaultLocationBackupLocation flag")
 	}
 
+	if dpa.Spec.Configuration.Velero.NoDefaultBackupLocation && dpa.BackupImages() {
+		return false, errors.New("backupImages needs to be set to false when noDefaultLocationBackupLocation is set")
+	}
+
 	if len(dpa.Spec.BackupLocations) > 0 {
 		for _, location := range dpa.Spec.BackupLocations {
 			// check for velero BSL config or cloud storage config
@@ -70,7 +74,7 @@ func (r *DPAReconciler) ValidateVeleroPlugins(log logr.Logger) (bool, error) {
 			pluginNeedsCheck = true
 		}
 
-		if ok && pluginSpecificMap.IsCloudProvider && pluginNeedsCheck {
+		if ok && pluginSpecificMap.IsCloudProvider && pluginNeedsCheck && !dpa.Spec.Configuration.Velero.NoDefaultBackupLocation {
 			secretName := pluginSpecificMap.SecretName
 			_, err := r.getProviderSecret(secretName)
 			if err != nil {
diff --git a/controllers/validator_test.go b/controllers/validator_test.go
index ed2d3cbfe4..adc41fc541 100644
--- a/controllers/validator_test.go
+++ b/controllers/validator_test.go
@@ -10,6 +10,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/tools/record"
+	"k8s.io/utils/pointer"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
@@ -22,7 +23,7 @@ func TestDPAReconciler_ValidateDataProtectionCR(t *testing.T) {
 		wantErr bool
 	}{
 		{
-			name: "given valid DPA CR, no error case",
+			name: "given valid DPA CR, no default backup location, no backup images, no error case",
 			dpa: &oadpv1alpha1.DataProtectionApplication{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-DPA-CR",
@@ -37,21 +38,37 @@ func TestDPAReconciler_ValidateDataProtectionCR(t *testing.T) {
 							NoDefaultBackupLocation: true,
 						},
 					},
+					BackupImages: pointer.Bool(false),
 				},
 			},
-			objects: []client.Object{
-				&corev1.Secret{
-					ObjectMeta: metav1.ObjectMeta{
-						Name:      "cloud-credentials",
-						Namespace: "test-ns",
+			objects: []client.Object{},
+			wantErr: false,
+			want:    true,
+		},
+		{
+			name: "given valid DPA CR, no default backup location, backup images cannot be nil, error case",
+			dpa: &oadpv1alpha1.DataProtectionApplication{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-DPA-CR",
+					Namespace: "test-ns",
+				},
+				Spec: oadpv1alpha1.DataProtectionApplicationSpec{
+					Configuration: &oadpv1alpha1.ApplicationConfig{
+						Velero: &oadpv1alpha1.VeleroConfig{
+							DefaultPlugins: []oadpv1alpha1.DefaultPlugin{
+								oadpv1alpha1.DefaultPluginAWS,
+							},
+							NoDefaultBackupLocation: true,
+						},
 					},
 				},
 			},
-			wantErr: false,
-			want:    true,
+			objects: []client.Object{},
+			wantErr: true,
+			want:    false,
 		},
 		{
-			name: "given valid DPA CR, error case",
+			name: "given valid DPA CR, no default backup location, backup images cannot be true, error case",
 			dpa: &oadpv1alpha1.DataProtectionApplication{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-DPA-CR",
@@ -66,6 +83,7 @@ func TestDPAReconciler_ValidateDataProtectionCR(t *testing.T) {
 							NoDefaultBackupLocation: true,
 						},
 					},
+					BackupImages: pointer.Bool(true),
 				},
 			},
 			objects: []client.Object{},
diff --git a/tests/e2e/backup_restore_suite_test.go b/tests/e2e/backup_restore_suite_test.go
index ee276a178a..4285639937 100755
--- a/tests/e2e/backup_restore_suite_test.go
+++ b/tests/e2e/backup_restore_suite_test.go
@@ -86,7 +86,7 @@ var _ = Describe("AWS backup restore tests", func() {
 				Expect(err).ToNot(HaveOccurred())
 			}
 
-			if dpaCR.CustomResource.Spec.BackupImages == nil || *dpaCR.CustomResource.Spec.BackupImages {
+			if dpaCR.CustomResource.BackupImages() {
 				log.Printf("Waiting for registry pods to be running")
 				Eventually(AreRegistryDeploymentsAvailable(namespace), timeoutMultiplier*time.Minute*3, time.Second*5).Should(BeTrue())
 			}
diff --git a/tests/e2e/dpa_deployment_suite_test.go b/tests/e2e/dpa_deployment_suite_test.go
index e3548b2388..25805bc3a7 100644
--- a/tests/e2e/dpa_deployment_suite_test.go
+++ b/tests/e2e/dpa_deployment_suite_test.go
@@ -601,7 +601,7 @@ var _ = Describe("Configuration testing for DPA Custom Resource", func() {
 					Eventually(ResticDaemonSetHasNodeSelector(namespace, key, value), timeoutMultiplier*time.Minute*3, time.Second*5).Should(BeTrue())
 				}
 			}
-			if dpa.Spec.BackupImages == nil || *installCase.DpaSpec.BackupImages {
+			if dpa.BackupImages() {
 				log.Printf("Waiting for registry pods to be running")
 				Eventually(AreRegistryDeploymentsAvailable(namespace), timeoutMultiplier*time.Minute*3, time.Second*5).Should(BeTrue())
 			}
diff --git a/tests/e2e/subscription_suite_test.go b/tests/e2e/subscription_suite_test.go
index 268ae1eee5..cd9ac0360e 100644
--- a/tests/e2e/subscription_suite_test.go
+++ b/tests/e2e/subscription_suite_test.go
@@ -76,7 +76,7 @@ var _ = Describe("Subscription Config Suite Test", func() {
 					log.Printf("Waiting for restic pods to be running")
 					Eventually(AreResticPodsRunning(namespace), timeoutMultiplier*time.Minute*3, time.Second*5).Should(BeTrue())
 				}
-				if velero.Spec.BackupImages == nil || *velero.Spec.BackupImages {
+				if velero.BackupImages() {
 					log.Printf("Waiting for registry pods to be running")
 					Eventually(AreRegistryDeploymentsAvailable(namespace), timeoutMultiplier*time.Minute*3, time.Second*5).Should(BeTrue())
 				}