diff --git a/core/hub.go b/core/hub.go
index aad920838f..8ed486080d 100644
--- a/core/hub.go
+++ b/core/hub.go
@@ -464,6 +464,9 @@ func handleGetConfig(path string) (*config.RawConfig, error) {
 	if err != nil {
 		return nil, err
 	}
+	if !prof.IPv6 {
+		prof.Tun.Inet6Address = nil
+	}
 	return prof, nil
 }
 
diff --git a/core/hub_test.go b/core/hub_test.go
new file mode 100644
index 0000000000..a65e579436
--- /dev/null
+++ b/core/hub_test.go
@@ -0,0 +1,22 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestHandleGetConfigOmitsTunIPv6WhenIPv6IsDisabled(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.yaml")
+	if err := os.WriteFile(path, []byte("ipv6: false\ntun:\n  enable: true\n"), 0o600); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	config, err := handleGetConfig(path)
+	if err != nil {
+		t.Fatalf("get config: %v", err)
+	}
+	if len(config.Tun.Inet6Address) != 0 {
+		t.Fatalf("tun inet6-address = %v, want no addresses when IPv6 is disabled", config.Tun.Inet6Address)
+	}
+}