diff --git a/management/internals/modules/reverseproxy/service/service.go b/management/internals/modules/reverseproxy/service/service.go
index 1504845b1..bc54aa240 100644
--- a/management/internals/modules/reverseproxy/service/service.go
+++ b/management/internals/modules/reverseproxy/service/service.go
@@ -825,7 +825,7 @@ func restrictionsFromAPI(r *api.AccessRestrictions) (AccessRestrictions, error)
 func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
 	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
 		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" {
+		r.CrowdSecMode == "" && r.AllowMatch == "" {
 		return nil
 	}
 	res := &api.AccessRestrictions{}
@@ -855,7 +855,7 @@ func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
 func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
 	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
 		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" {
+		r.CrowdSecMode == "" && r.AllowMatch == "" {
 		return nil
 	}
 	return &proto.AccessRestrictions{
diff --git a/management/internals/modules/reverseproxy/service/service_test.go b/management/internals/modules/reverseproxy/service/service_test.go
index 4756c1106..5151956a6 100644
--- a/management/internals/modules/reverseproxy/service/service_test.go
+++ b/management/internals/modules/reverseproxy/service/service_test.go
@@ -1337,6 +1337,21 @@ func TestRestrictions_AllowMatch_EmptyDefaultsToAll(t *testing.T) {
 	assert.Nil(t, apiOut.AllowMatch, "empty allow_match is omitted from the API response")
 }
 
+func TestRestrictions_AllowMatchOnly_Preserved(t *testing.T) {
+	// allow_match set without any list must not be dropped by the emptiness
+	// guards, so it round-trips through both the API and proto conversions.
+	model := AccessRestrictions{AllowMatch: "any"}
+
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut, "allow-match-only restriction must not be omitted from the API response")
+	require.NotNil(t, apiOut.AllowMatch)
+	assert.Equal(t, api.AccessRestrictionsAllowMatchAny, *apiOut.AllowMatch)
+
+	protoOut := restrictionsToProto(model)
+	require.NotNil(t, protoOut, "allow-match-only restriction must not be omitted from the proto output")
+	assert.Equal(t, "any", protoOut.AllowMatch)
+}
+
 func TestValidate_RejectsInvalidAllowMatch(t *testing.T) {
 	rp := validProxy()
 	rp.Restrictions = AccessRestrictions{