diff --git a/lb/controller.go b/lb/controller.go
index 31a00a19..bfcdf05f 100644
--- a/lb/controller.go
+++ b/lb/controller.go
@@ -389,6 +389,12 @@ func (c *Controller) admit(ctx context.Context, req admit.Request) (bool, int, e
 		c.fetched[key] = pod
 	}
 	if err := c.sync(ctx); err != nil {
+		// with no EgressService and no member rules in place there is nothing to protect or to clean up for
+		// this IP: a broken pass must not stop every pod on the node from starting
+		if len(c.lastEgress.Members) == 0 && (c.egresses == nil || len(c.egresses.List()) == 0) {
+			common.Log.Warnf("lb: admitting %s/%s despite a failed pass (no EgressServices): %v", req.Namespace, req.Name, err)
+			return false, http.StatusOK, nil
+		}
 		return false, http.StatusServiceUnavailable, err
 	}
 	for _, m := range c.lastEgress.Members {