diff --git a/fleetshard/pkg/central/reconciler/reconciler.go b/fleetshard/pkg/central/reconciler/reconciler.go
index 21618c4ff1..0c5e287e45 100644
--- a/fleetshard/pkg/central/reconciler/reconciler.go
+++ b/fleetshard/pkg/central/reconciler/reconciler.go
@@ -347,8 +347,9 @@ func (r *CentralReconciler) applyTelemetry(remoteCentral *private.ManagedCentral
 		central.Spec.Central = &v1alpha1.CentralComponentSpec{}
 	}
 	// Telemetry is always enabled, but the key is set to DISABLED for probe and other internal instances.
+	// Cloud-service specificity: empty key also disables telemetry to prevent reporting to the self-managed bucket.
 	key := r.telemetry.StorageKey
-	if remoteCentral.Metadata.Internal {
+	if remoteCentral.Metadata.Internal || key == "" {
 		key = "DISABLED"
 	}
 	telemetry := &v1alpha1.Telemetry{
diff --git a/fleetshard/pkg/central/reconciler/reconciler_test.go b/fleetshard/pkg/central/reconciler/reconciler_test.go
index c03d65a364..2a8561b0c6 100644
--- a/fleetshard/pkg/central/reconciler/reconciler_test.go
+++ b/fleetshard/pkg/central/reconciler/reconciler_test.go
@@ -1959,23 +1959,25 @@ func Test_getCentralConfig_telemetry(t *testing.T) {
 		assert func(t *testing.T, c *v1alpha1.Central)
 	}{
 		{
-			name: "should disable telemetry when no storage key is set",
+			name: "telemetry enabled, but DISABLED when no storage key is set",
 			args: args{
 				isInternal: false,
 				storageKey: "",
 			},
 			assert: func(t *testing.T, c *v1alpha1.Central) {
-				assert.False(t, *c.Spec.Central.Telemetry.Enabled)
+				assert.True(t, *c.Spec.Central.Telemetry.Enabled)
+				assert.Equal(t, "DISABLED", *c.Spec.Central.Telemetry.Storage.Key)
 			},
 		},
 		{
-			name: "should disable telemetry when managed central is internal",
+			name: "should DISABLE telemetry key when managed central is internal",
 			args: args{
 				isInternal: true,
 				storageKey: "foo",
 			},
 			assert: func(t *testing.T, c *v1alpha1.Central) {
-				assert.False(t, *c.Spec.Central.Telemetry.Enabled)
+				assert.True(t, *c.Spec.Central.Telemetry.Enabled)
+				assert.Equal(t, "DISABLED", *c.Spec.Central.Telemetry.Storage.Key)
 			},
 		},
 		{
@@ -1985,18 +1987,18 @@ func Test_getCentralConfig_telemetry(t *testing.T) {
 				storageKey: "foo",
 			},
 			assert: func(t *testing.T, c *v1alpha1.Central) {
-				assert.False(t, *c.Spec.Central.Telemetry.Enabled)
+				assert.True(t, *c.Spec.Central.Telemetry.Enabled)
+				assert.Equal(t, "foo", *c.Spec.Central.Telemetry.Storage.Key)
 			},
 		},
 	}
 
 	for _, tc := range tcs {
 		t.Run(tc.name, func(t *testing.T) {
-			r := &CentralReconciler{}
-			if tc.args.isInternal {
-				r.telemetry = config.Telemetry{
+			r := &CentralReconciler{
+				telemetry: config.Telemetry{
 					StorageKey: tc.args.storageKey,
-				}
+				},
 			}
 			c := &v1alpha1.Central{}
 			mc := &private.ManagedCentral{
@@ -2184,10 +2186,10 @@ metadata:
 							},
 						},
 						Telemetry: &v1alpha1.Telemetry{
-							Enabled: pointer.Bool(false),
+							Enabled: pointer.Bool(true),
 							Storage: &v1alpha1.TelemetryStorage{
 								Endpoint: pointer.String(""),
-								Key:      pointer.String(""),
+								Key:      pointer.String("DISABLED"),
 							},
 						},
 					},