diff --git a/net/ippolicy/policy.go b/net/ippolicy/policy.go
index 070a13d..53788a3 100644
--- a/net/ippolicy/policy.go
+++ b/net/ippolicy/policy.go
@@ -213,7 +213,7 @@ func (p *Policy) Set(e *Evaluator) error {
 }
 
 func (p *Policy) Clear() error {
-	p.current.Store(nil)
+	p.current.Store(&Evaluator{})
 	p.loadedAt.Store(nil)
 	return nil
 }
diff --git a/net/ippolicy/policy_test.go b/net/ippolicy/policy_test.go
index 0edde3c..22ce6b8 100644
--- a/net/ippolicy/policy_test.go
+++ b/net/ippolicy/policy_test.go
@@ -27,6 +27,19 @@ func TestEnumStrings(t *testing.T) {
 	}
 }
 
+func TestPolicyClearPublishesEmptyEvaluator(t *testing.T) {
+	p := New(t.Context(), Config{})
+	if err := p.Clear(); err != nil {
+		t.Fatal(err)
+	}
+	if evaluator := p.Current(); evaluator == nil {
+		t.Fatal("Clear published nil evaluator")
+	}
+	if got := p.Current().Evaluate(netip.MustParseAddr("192.0.2.1")); got != Unlisted {
+		t.Fatalf("empty evaluator decision = %s, want %s", got, Unlisted)
+	}
+}
+
 func TestPolicyKeepsSnapshotAfterFailedRefresh(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "allowed.tsv")
 	if err := os.WriteFile(path, []byte("192.0.2.1\n"), 0o600); err != nil {