diff --git a/ee/server/service/vpp.go b/ee/server/service/vpp.go
index 3944768e43..6af48009f9 100644
--- a/ee/server/service/vpp.go
+++ b/ee/server/service/vpp.go
@@ -2,7 +2,6 @@ package service
 
 import (
 	"context"
-	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -25,7 +24,7 @@ func (svc *Service) getVPPToken(ctx context.Context) (string, error) {
 		return "", ctxerr.Wrap(ctx, err, "unmarshaling VPP token data")
 	}
 
-	return base64.StdEncoding.EncodeToString([]byte(vppTokenData.Token)), nil
+	return vppTokenData.Token, nil
 }
 
 func (svc *Service) GetAppStoreApps(ctx context.Context, teamID *uint) ([]*fleet.VPPApp, error) {
diff --git a/server/service/mdm.go b/server/service/mdm.go
index 545df4e6d5..bd80e45562 100644
--- a/server/service/mdm.go
+++ b/server/service/mdm.go
@@ -2624,13 +2624,8 @@ func (svc *Service) UploadMDMAppleVPPToken(ctx context.Context, token io.ReadSee
 		return ctxerr.Wrap(ctx, err, "validating VPP token with Apple")
 	}
 
-	decodedTokenBytes, err := base64.StdEncoding.DecodeString(string(tokenBytes))
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "decoding VPP token")
-	}
-
 	data := fleet.VPPTokenData{
-		Token:    string(decodedTokenBytes),
+		Token:    string(tokenBytes),
 		Location: locName,
 	}
 
@@ -2694,7 +2689,12 @@ func (svc *Service) GetMDMAppleVPPToken(ctx context.Context) (*fleet.VPPTokenInf
 	}
 
 	var rawToken fleet.VPPTokenRaw
-	if err := json.Unmarshal([]byte(tokenData.Token), &rawToken); err != nil {
+	decodedBytes, err := base64.StdEncoding.DecodeString(tokenData.Token)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "decoding VPP token")
+	}
+
+	if err := json.Unmarshal(decodedBytes, &rawToken); err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "unmarshaling VPP token")
 	}