diff --git a/site/profiles/manifests/consul/mesh_gateway.pp b/site/profiles/manifests/consul/mesh_gateway.pp
index d8e9cf4..07869be 100644
--- a/site/profiles/manifests/consul/mesh_gateway.pp
+++ b/site/profiles/manifests/consul/mesh_gateway.pp
@@ -8,41 +8,45 @@ class profiles::consul::mesh_gateway (
 ) {
   include profiles::consul::client
 
-  package { 'envoy':
-    ensure => installed,
-  }
+  # include after profiles::consul::server, which declares Class['consul'] only once /data is mounted
+  if defined(Class['consul']) {
+    package { 'envoy':
+      ensure => installed,
+    }
 
-  file { $token_file:
-    ensure  => file,
-    owner   => 'consul',
-    group   => 'consul',
-    mode    => '0600',
-    content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${profiles::consul::client::secret_id_salt}")),
-  }
+    file { $token_file:
+      ensure  => file,
+      owner   => 'consul',
+      group   => 'consul',
+      mode    => '0600',
+      require => Class['consul'],
+      content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${profiles::consul::client::secret_id_salt}")),
+    }
 
-  systemd::unit_file { 'consul-mesh-gateway.service':
-    enable    => true,
-    active    => true,
-    content   => @("UNIT"),
-      [Unit]
-      Description=Consul mesh gateway (envoy)
-      Requires=consul.service
-      After=consul.service
+    systemd::unit_file { 'consul-mesh-gateway.service':
+      enable    => true,
+      active    => true,
+      content   => @("UNIT"),
+        [Unit]
+        Description=Consul mesh gateway (envoy)
+        Requires=consul.service
+        After=consul.service
 
-      [Service]
-      User=consul
-      Group=consul
-      ExecStart=/usr/bin/consul connect envoy -gateway=mesh -register -service=mesh-gateway -expose-servers \
-        -address=${address}:${port} -wan-address=${address}:${port} \
-        -http-addr=http://${address}:${http_port} -grpc-addr=http://${address}:${grpc_port} \
-        -token-file=${token_file}
-      Restart=on-failure
-      RestartSec=5
+        [Service]
+        User=consul
+        Group=consul
+        ExecStart=/usr/bin/consul connect envoy -gateway=mesh -register -service=mesh-gateway -expose-servers \
+          -address=${address}:${port} -wan-address=${address}:${port} \
+          -http-addr=http://${address}:${http_port} -grpc-addr=http://${address}:${grpc_port} \
+          -token-file=${token_file}
+        Restart=on-failure
+        RestartSec=5
 
-      [Install]
-      WantedBy=multi-user.target
-      | UNIT
-    require   => Package['envoy'],
-    subscribe => File[$token_file],
+        [Install]
+        WantedBy=multi-user.target
+        | UNIT
+      require   => [Package['envoy'], Class['consul']],
+      subscribe => File[$token_file],
+    }
   }
 }