diff --git a/CHANGELOG.md b/CHANGELOG.md
index afa61a261..f097c23c8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 ## [Unreleased]
 
 - Fix setting `id` for Fleet outputs and servers ([#666](https://github.com/elastic/terraform-provider-elasticstack/pull/666))
+- Fix `elasticstack_fleet_enrollment_tokens` returning empty tokens in some case ([#683](https://github.com/elastic/terraform-provider-elasticstack/pull/683))
 
 ## [0.11.4] - 2024-06-13
 
@@ -160,7 +161,7 @@
 - Add `elasticstack_elasticsearch_watch` for managing Elasticsearch Watches ([#155](https://github.com/elastic/terraform-provider-elasticstack/pull/155))
 - Add `elasticstack_kibana_alerting_rule` for managing Kibana alerting rules ([#292](https://github.com/elastic/terraform-provider-elasticstack/pull/292))
 - Add client for communicating with the Fleet APIs ([#311](https://github.com/elastic/terraform-provider-elasticstack/pull/311)])
-- Add `elasticstack_fleet_enrollment_tokens` and `elasticstack_fleet_agent_policy` for managing Fleet enrollment tokens and agent policies ([#322](https://github.com/elastic/terraform-provider-elasticstack/pull/322)])
+- Add `elasticstack_fleet_enrollment_tokens` and `elasticstack_fleet_agent_policy` for managing Fleet enrollment tokens and agent policies ([#322](https://github.com/elastic/terraform-provider-elasticstack/pull/322))
 - Add `elasticstack_fleet_output` and `elasticstack_fleet_server_host` for managing Fleet outputs and server hosts ([#327](https://github.com/elastic/terraform-provider-elasticstack/pull/327)])
 - Add `elasticstack_kibana_action_connector` for managing Kibana action connectors ([#306](https://github.com/elastic/terraform-provider-elasticstack/pull/306))
 
diff --git a/internal/clients/fleet/fleet.go b/internal/clients/fleet/fleet.go
index 5655dd58d..0bf11ee4e 100644
--- a/internal/clients/fleet/fleet.go
+++ b/internal/clients/fleet/fleet.go
@@ -28,6 +28,25 @@ func AllEnrollmentTokens(ctx context.Context, client *Client) ([]fleetapi.Enroll
 	return nil, reportUnknownError(resp.StatusCode(), resp.Body)
 }
 
+// GetEnrollmentTokensByPolicy Get enrollment tokens by given policy ID
+func GetEnrollmentTokensByPolicy(ctx context.Context, client *Client, policyID string) ([]fleetapi.EnrollmentApiKey, diag.Diagnostics) {
+	resp, err := client.API.GetEnrollmentApiKeysWithResponse(ctx, func(ctx context.Context, req *http.Request) error {
+		q := req.URL.Query()
+		q.Set("kuery", "policy_id:"+policyID)
+		req.URL.RawQuery = q.Encode()
+
+		return nil
+	})
+	if err != nil {
+		return nil, diag.FromErr(err)
+	}
+
+	if resp.StatusCode() == http.StatusOK {
+		return resp.JSON200.Items, nil
+	}
+	return nil, reportUnknownError(resp.StatusCode(), resp.Body)
+}
+
 // ReadAgentPolicy reads a specific agent policy from the API.
 func ReadAgentPolicy(ctx context.Context, client *Client, id string) (*fleetapi.AgentPolicy, diag.Diagnostics) {
 	resp, err := client.API.AgentPolicyInfoWithResponse(ctx, id)
diff --git a/internal/fleet/enrollment_tokens_data_source.go b/internal/fleet/enrollment_tokens_data_source.go
index 5f0fe851a..a0790637c 100644
--- a/internal/fleet/enrollment_tokens_data_source.go
+++ b/internal/fleet/enrollment_tokens_data_source.go
@@ -3,6 +3,7 @@ package fleet
 import (
 	"context"
 
+	fleetapi "github.com/elastic/terraform-provider-elasticstack/generated/fleet"
 	"github.com/elastic/terraform-provider-elasticstack/internal/clients/fleet"
 	"github.com/elastic/terraform-provider-elasticstack/internal/utils"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -83,7 +84,14 @@ func dataSourceEnrollmentTokensRead(ctx context.Context, d *schema.ResourceData,
 	}
 	policyID := d.Id()
 
-	allTokens, diags := fleet.AllEnrollmentTokens(ctx, fleetClient)
+	var allTokens []fleetapi.EnrollmentApiKey
+
+	if policyID == "" {
+		allTokens, diags = fleet.AllEnrollmentTokens(ctx, fleetClient)
+	} else {
+		allTokens, diags = fleet.GetEnrollmentTokensByPolicy(ctx, fleetClient, policyID)
+	}
+
 	if diags.HasError() {
 		return diags
 	}