diff --git a/config/options.go b/config/options.go
index 74b1b52d7..d4914933f 100644
--- a/config/options.go
+++ b/config/options.go
@@ -1495,7 +1495,9 @@ func (o *Options) ApplySettings(ctx context.Context, certsIndex *cryptutil.Certi
 	set(&o.SigningKey, settings.SigningKey)
 	setMap(&o.SetResponseHeaders, settings.SetResponseHeaders)
 	setMap(&o.JWTClaimsHeaders, settings.JwtClaimsHeaders)
-	o.JWTGroupsFilter = NewJWTGroupsFilter(settings.JwtGroupsFilter)
+	if len(settings.JwtGroupsFilter) > 0 {
+		o.JWTGroupsFilter = NewJWTGroupsFilter(settings.JwtGroupsFilter)
+	}
 	setDuration(&o.DefaultUpstreamTimeout, settings.DefaultUpstreamTimeout)
 	set(&o.MetricsAddr, settings.MetricsAddress)
 	set(&o.MetricsBasicAuth, settings.MetricsBasicAuth)
diff --git a/config/options_test.go b/config/options_test.go
index c4c0271f5..03aa8a39e 100644
--- a/config/options_test.go
+++ b/config/options_test.go
@@ -976,6 +976,19 @@ func TestOptions_ApplySettings(t *testing.T) {
 		})
 		assert.Equal(t, "#333333", options.BrandingOptions.GetPrimaryColor())
 	})
+
+	t.Run("jwt_groups_filter", func(t *testing.T) {
+		options := NewDefaultOptions()
+		options.ApplySettings(ctx, nil, &configpb.Settings{
+			JwtGroupsFilter: []string{"foo", "bar", "baz"},
+		})
+		options.ApplySettings(ctx, nil, &configpb.Settings{})
+		assert.Equal(t, NewJWTGroupsFilter([]string{"foo", "bar", "baz"}), options.JWTGroupsFilter)
+		options.ApplySettings(ctx, nil, &configpb.Settings{
+			JwtGroupsFilter: []string{"quux", "zulu"},
+		})
+		assert.Equal(t, NewJWTGroupsFilter([]string{"quux", "zulu"}), options.JWTGroupsFilter)
+	})
 }
 
 func TestOptions_GetSetResponseHeaders(t *testing.T) {