diff --git a/src/fgai/config.py b/src/fgai/config.py
index 8115aa1..132c2a2 100644
--- a/src/fgai/config.py
+++ b/src/fgai/config.py
@@ -82,10 +82,13 @@ class ConfigStore:
             elif key == "threat_intel_provider" and value in {"auto", "abuseipdb", "virustotal"}:
                 current[key] = value
             elif key == "graylog_streams" and isinstance(value, list):
-                current[key] = [
+                streams = [
                     {"id": str(item.get("id", "")), "title": str(item.get("title", "")), "enabled": bool(item.get("enabled"))}
                     for item in value if isinstance(item, dict) and item.get("id")
                 ]
+                if not streams and current.get("graylog_streams"):
+                    continue
+                current[key] = streams
             elif key == "graylog_stream_profiles" and isinstance(value, list):
                 current[key] = [item for item in value if isinstance(item, dict) and item.get("stream_id")]
             elif isinstance(value, str):
diff --git a/tests/test_config.py b/tests/test_config.py
index 4f40f32..3c8aa33 100644
--- a/tests/test_config.py
+++ b/tests/test_config.py
@@ -54,6 +54,13 @@ class ConfigTests(unittest.TestCase):
             public = store.update({"graylog_tls_verify": False})
             self.assertFalse(public["graylog_tls_verify"])
 
+    def test_empty_stream_update_does_not_clear_existing_streams(self):
+        with tempfile.TemporaryDirectory() as directory:
+            store = ConfigStore(str(Path(directory) / "config.json"))
+            store.update({"graylog_streams": [{"id": "stream-1", "title": "Firewall", "enabled": True}]})
+            public = store.update({"graylog_streams": []})
+            self.assertEqual(public["graylog_streams"], [{"id": "stream-1", "title": "Firewall", "enabled": True}])
+
 
 if __name__ == "__main__":
     unittest.main()