diff --git a/java/google/registry/flows/domain/DomainFlowUtils.java b/java/google/registry/flows/domain/DomainFlowUtils.java
index 9458657e4..f30ef953f 100644
--- a/java/google/registry/flows/domain/DomainFlowUtils.java
+++ b/java/google/registry/flows/domain/DomainFlowUtils.java
@@ -318,8 +318,9 @@ public class DomainFlowUtils {
   static void validateRegistrantAllowedOnTld(String tld, String registrantContactId)
       throws RegistrantNotAllowedException {
     ImmutableSet<String> whitelist = Registry.get(tld).getAllowedRegistrantContactIds();
-    // Empty whitelists are ignored.
-    if (!whitelist.isEmpty() && !whitelist.contains(registrantContactId)) {
+    // Empty whitelists or null registrantContactId are ignored.
+    if (registrantContactId != null && !whitelist.isEmpty() 
+        && !whitelist.contains(registrantContactId)) {
       throw new RegistrantNotAllowedException(registrantContactId);
     }
   }
diff --git a/javatests/google/registry/flows/domain/DomainUpdateFlowTest.java b/javatests/google/registry/flows/domain/DomainUpdateFlowTest.java
index f6cabb22b..2c4458755 100644
--- a/javatests/google/registry/flows/domain/DomainUpdateFlowTest.java
+++ b/javatests/google/registry/flows/domain/DomainUpdateFlowTest.java
@@ -1094,6 +1094,24 @@ public class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow,
     runFlow();
   }
 
+  @Test
+  public void testSuccess_newNameserverWhitelisted() throws Exception {
+    setEppInput("domain_update_add_nameserver.xml");
+    persistReferencedEntities();
+    persistDomain();
+    // No registrant is given but both nameserver and registrant whitelist exist.
+    persistResource(
+        Registry.get("tld").asBuilder()
+            .setAllowedRegistrantContactIds(ImmutableSet.of("sh8013"))
+            .setAllowedFullyQualifiedHostNames(ImmutableSet.of("ns2.example.foo"))
+            .build());
+    assertThat(reloadResourceByUniqueId().getNameservers()).doesNotContain(
+        Ref.create(loadByUniqueId(HostResource.class, "ns2.example.foo", clock.nowUtc())));
+    runFlow();
+    assertThat(reloadResourceByUniqueId().getNameservers()).contains(
+        Ref.create(loadByUniqueId(HostResource.class, "ns2.example.foo", clock.nowUtc())));
+  }
+
   @Test
   public void testSuccess_nameserverAndRegistrantWhitelisted() throws Exception {
     persistReferencedEntities();