diff --git a/lib/auth/autoupdate/autoupdatev1/service.go b/lib/auth/autoupdate/autoupdatev1/service.go
index 69692b6135dfb..64721b85837be 100644
--- a/lib/auth/autoupdate/autoupdatev1/service.go
+++ b/lib/auth/autoupdate/autoupdatev1/service.go
@@ -657,6 +657,10 @@ var (
 // This function should not be confused with api/types/autoupdate.ValidateAutoUpdateConfig which validates the integrity
 // of the resource and does not enforce potentially changing rules.
 func validateServerSideAgentConfig(config *autoupdate.AutoUpdateConfig) error {
+	agentsSpec := config.GetSpec().GetAgents()
+	if agentsSpec == nil {
+		return nil
+	}
 	// We must check resource integrity before, because it makes no sense to try to enforce rules on an invalid resource.
 	// The generic backend service will likely check integrity again, but it's not a large performance problem.
 	err := update.ValidateAutoUpdateConfig(config)
@@ -667,7 +671,6 @@ func validateServerSideAgentConfig(config *autoupdate.AutoUpdateConfig) error {
 	var maxGroups int
 	isCloud := modules.GetModules().Features().Cloud
 
-	agentsSpec := config.GetSpec().GetAgents()
 	switch {
 	case isCloud && agentsSpec.GetStrategy() == update.AgentsStrategyHaltOnError:
 		maxGroups = maxGroupsHaltOnErrorStrategyCloud
diff --git a/lib/auth/autoupdate/autoupdatev1/service_test.go b/lib/auth/autoupdate/autoupdatev1/service_test.go
index c1bab9f084d6b..a8061801f36f8 100644
--- a/lib/auth/autoupdate/autoupdatev1/service_test.go
+++ b/lib/auth/autoupdate/autoupdatev1/service_test.go
@@ -666,6 +666,12 @@ func TestValidateServerSideAgentConfig(t *testing.T) {
 		modules   modules.Modules
 		expectErr require.ErrorAssertionFunc
 	}{
+		{
+			name:      "empty agent config",
+			modules:   selfHostedModules,
+			config:    nil,
+			expectErr: require.NoError,
+		},
 		{
 			name:    "over max groups time-based",
 			modules: selfHostedModules,