diff --git a/hscontrol/policy/v2/filter.go b/hscontrol/policy/v2/filter.go
index df2b6826..e7cb1d5c 100644
--- a/hscontrol/policy/v2/filter.go
+++ b/hscontrol/policy/v2/filter.go
@@ -137,7 +137,7 @@ func (pol *Policy) compileFilterRules(
 	users types.Users,
 	nodes views.Slice[types.NodeView],
 ) ([]tailcfg.FilterRule, error) {
-	if pol == nil || pol.ACLs == nil {
+	if pol == nil || (pol.ACLs == nil && len(pol.Grants) == 0) {
 		return tailcfg.FilterAllowAll, nil
 	}