diff --git a/config/config_test.go b/config/config_test.go
index 6ccc22e84..acba6450e 100644
--- a/config/config_test.go
+++ b/config/config_test.go
@@ -1825,6 +1825,10 @@ var expectedErrors = []struct {
 		filename: "puppetdb_no_scheme.bad.yml",
 		errMsg:   "URL scheme must be 'http' or 'https'",
 	},
+	{
+		filename: "puppetdb_token_file.bad.yml",
+		errMsg:   "at most one of bearer_token & bearer_token_file must be configured",
+	},
 	{
 		filename: "hetzner_role.bad.yml",
 		errMsg:   "unknown role",
diff --git a/config/testdata/puppetdb_token_file.bad.yml b/config/testdata/puppetdb_token_file.bad.yml
new file mode 100644
index 000000000..7775f2d19
--- /dev/null
+++ b/config/testdata/puppetdb_token_file.bad.yml
@@ -0,0 +1,7 @@
+scrape_configs:
+- job_name: puppetdb
+  puppetdb_sd_configs:
+  - url: http://puppet
+    query: 'resources { type = "Package" and title = "httpd" }'
+    bearer_token: foo
+    bearer_token_file: foo
diff --git a/discovery/puppetdb/puppetdb.go b/discovery/puppetdb/puppetdb.go
index f22a2e22b..9484a0aa6 100644
--- a/discovery/puppetdb/puppetdb.go
+++ b/discovery/puppetdb/puppetdb.go
@@ -115,7 +115,7 @@ func (c *SDConfig) UnmarshalYAML(unmarshal func(interface{}) error) error {
 	if c.Query == "" {
 		return fmt.Errorf("query missing")
 	}
-	return nil
+	return c.HTTPClientConfig.Validate()
 }
 
 // Discovery provides service discovery functionality based