diff --git a/pkg/asset/machines/azure/azuremachines.go b/pkg/asset/machines/azure/azuremachines.go
index 255e1a5cb5..e9fb2e0403 100644
--- a/pkg/asset/machines/azure/azuremachines.go
+++ b/pkg/asset/machines/azure/azuremachines.go
@@ -390,7 +390,7 @@ func capzImage(osImage aztypes.OSImage, azEnv aztypes.CloudEnvironment, confiden
 	case rhcosImg == "" && !confidentialVM:
 		// hive calls the machines function, but may pass an empty
 		// string for rhcos. In which case, allow MAO to choose default.
-		return nil
+		return &capz.Image{} // can't be nil or mapiImage will panic
 	default: // Installer-created image gallery, for OKD && confidential VMs.
 		// image gallery names cannot have dashes
 		galleryName := strings.ReplaceAll(infraID, "-", "_")
diff --git a/pkg/asset/machines/azure/machines.go b/pkg/asset/machines/azure/machines.go
index 4f20b75812..fd39d4db5a 100644
--- a/pkg/asset/machines/azure/machines.go
+++ b/pkg/asset/machines/azure/machines.go
@@ -433,11 +433,6 @@ func generateSecurityProfile(mpool *azure.MachinePool) *machineapi.SecurityProfi
 
 func mapiImage(osImage azure.OSImage, azEnv azure.CloudEnvironment, confidentialVM bool, gen, rg, sub, infraID, rhcosImg string) machineapi.Image {
 	mImg := machineapi.Image{}
-	// hive uses this package, but may pass an empty string for rhcosImg,
-	// in which case we want to depend on MAO default, so return empty.
-	if rhcosImg == "" {
-		return mImg
-	}
 	cImg := capzImage(osImage, azEnv, confidentialVM, gen, rg, sub, infraID, rhcosImg)
 
 	if cImg.ID != nil {