diff --git a/backend/internal/app/management_renewal.go b/backend/internal/app/management_renewal.go
index f4d5667..8865228 100644
--- a/backend/internal/app/management_renewal.go
+++ b/backend/internal/app/management_renewal.go
@@ -47,7 +47,7 @@ func (m *managementRenewal) RunRenewal(ctx context.Context, policy certificate.R
 	}
 	state, err := m.readState()
 	// 公网 IP 自签证书不进入域名的 ACME DNS 续期流程。
-	if state.Hostname == "" {
+	if err == nil && state.Hostname == "" {
 		return report, nil
 	}
 	report.Checked = 1
diff --git a/backend/internal/app/management_renewal_test.go b/backend/internal/app/management_renewal_test.go
index 2d4cbb9..17a621b 100644
--- a/backend/internal/app/management_renewal_test.go
+++ b/backend/internal/app/management_renewal_test.go
@@ -324,6 +324,18 @@ func TestManagementRenewalRecordsUnreadableCertificate(t *testing.T) {
 	}
 }
 
+func TestManagementRenewalRecordsUnreadableEmptyState(t *testing.T) {
+	f := newManagementFixture(t)
+	f.m.readState = func() (httpapi.ManagementCertificateState, error) {
+		return httpapi.ManagementCertificateState{}, errors.New("empty management certificate state read failure")
+	}
+	report, err := f.m.RunRenewal(t.Context(), f.policy, f.now)
+	if err == nil || report.Checked != 1 || report.Failed != 1 || f.issues != 0 {
+		t.Fatalf("empty state read failure was incorrectly skipped: %+v %v", report, err)
+	}
+	f.assertTask(t, "failed", 0)
+}
+
 type managementFailAudit struct {
 	repository.AuditRepository
 }