diff --git a/java/google/registry/tools/CreateOrUpdateRegistrarCommand.java b/java/google/registry/tools/CreateOrUpdateRegistrarCommand.java
index 4b2bc3028..d955ff4f0 100644
--- a/java/google/registry/tools/CreateOrUpdateRegistrarCommand.java
+++ b/java/google/registry/tools/CreateOrUpdateRegistrarCommand.java
@@ -154,7 +154,7 @@ abstract class CreateOrUpdateRegistrarCommand extends MutatingCommand {
 
   @Parameter(
       names = "--ip_whitelist",
-      description = "Comma-delimited list of IP ranges")
+      description = "Comma-delimited list of IP ranges. An empty string clears the whitelist.")
   List<String> ipWhitelist = new ArrayList<>();
 
   @Nullable
@@ -332,7 +332,9 @@ abstract class CreateOrUpdateRegistrarCommand extends MutatingCommand {
         ImmutableList.Builder<CidrAddressBlock> ipWhitelistBuilder = new ImmutableList.Builder<>();
         if (!(ipWhitelist.size() == 1 && ipWhitelist.get(0).contains("null"))) {
           for (String ipRange : ipWhitelist) {
-            ipWhitelistBuilder.add(CidrAddressBlock.create(ipRange));
+            if (!ipRange.isEmpty()) {
+              ipWhitelistBuilder.add(CidrAddressBlock.create(ipRange));
+            }
           }
         }
         builder.setIpAddressWhitelist(ipWhitelistBuilder.build());
diff --git a/javatests/google/registry/tools/UpdateRegistrarCommandTest.java b/javatests/google/registry/tools/UpdateRegistrarCommandTest.java
index 44458fa1f..a911156c5 100644
--- a/javatests/google/registry/tools/UpdateRegistrarCommandTest.java
+++ b/javatests/google/registry/tools/UpdateRegistrarCommandTest.java
@@ -134,7 +134,7 @@ public class UpdateRegistrarCommandTest extends CommandTestCase<UpdateRegistrarC
   }
 
   @Test
-  public void testSuccess_clearIpWhitelist() throws Exception {
+  public void testSuccess_clearIpWhitelist_useNull() throws Exception {
     persistResource(
         loadRegistrar("NewRegistrar")
             .asBuilder()
@@ -148,6 +148,21 @@ public class UpdateRegistrarCommandTest extends CommandTestCase<UpdateRegistrarC
     assertThat(loadRegistrar("NewRegistrar").getIpAddressWhitelist()).isEmpty();
   }
 
+  @Test
+  public void testSuccess_clearIpWhitelist_useEmpty() throws Exception {
+    persistResource(
+        loadRegistrar("NewRegistrar")
+            .asBuilder()
+            .setIpAddressWhitelist(
+                ImmutableList.of(
+                    CidrAddressBlock.create("192.168.1.1"),
+                    CidrAddressBlock.create("192.168.0.2/16")))
+            .build());
+    assertThat(loadRegistrar("NewRegistrar").getIpAddressWhitelist()).isNotEmpty();
+    runCommand("--ip_whitelist=", "--force", "NewRegistrar");
+    assertThat(loadRegistrar("NewRegistrar").getIpAddressWhitelist()).isEmpty();
+  }
+
   @Test
   public void testSuccess_certFile() throws Exception {
     Registrar registrar = loadRegistrar("NewRegistrar");