diff --git a/internal/machine/cluster/cluster.go b/internal/machine/cluster/cluster.go
index d2e65be4..8142b77b 100644
--- a/internal/machine/cluster/cluster.go
+++ b/internal/machine/cluster/cluster.go
@@ -260,6 +260,9 @@ func (c *Cluster) UpdateMachine(ctx context.Context, req *pb.UpdateMachineReques
 		}
 	}
 	if req.Endpoints != nil {
+		if len(req.Endpoints) == 0 {
+			return nil, status.Error(codes.InvalidArgument, "endpoints cannot be empty")
+		}
 		updatedMachine.Network.Endpoints = req.Endpoints
 	}
 
diff --git a/test/e2e/machine_test.go b/test/e2e/machine_test.go
index 62184fe8..fa40f3b9 100644
--- a/test/e2e/machine_test.go
+++ b/test/e2e/machine_test.go
@@ -10,6 +10,8 @@ import (
 	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 func TestMachineRename(t *testing.T) {
@@ -359,6 +361,23 @@ func TestUpdateMachine(t *testing.T) {
 		assert.Equal(t, targetMachine.Machine.Network.Subnet.Bits, updatedMachine.Network.Subnet.Bits)
 		assert.Equal(t, targetMachine.Machine.Network.ManagementIp.Ip, updatedMachine.Network.ManagementIp.Ip)
 		assert.Equal(t, targetMachine.Machine.Network.PublicKey, updatedMachine.Network.PublicKey)
+
+		// Try to update with empty endpoints (should be rejected).
+		req = &pb.UpdateMachineRequest{
+			MachineId: targetMachine.Machine.Id,
+			Endpoints: []*pb.IPPort{},
+		}
+		_, err = cli.UpdateMachine(ctx, req)
+		require.Error(t, err)
+
+		st, ok := status.FromError(err)
+		require.True(t, ok)
+		assert.Equal(t, codes.InvalidArgument, st.Code())
+
+		// Verify endpoints remain unchanged.
+		inspected, err := cli.InspectMachine(ctx, targetMachine.Machine.Id)
+		require.NoError(t, err)
+		assert.Equal(t, newEndpoints, inspected.Machine.Network.Endpoints)
 	})
 
 	t.Run("update multiple fields simultaneously", func(t *testing.T) {