diff --git a/pkg/proxy/topology.go b/pkg/proxy/topology.go
index c91961d7cec..c76ea30c91d 100644
--- a/pkg/proxy/topology.go
+++ b/pkg/proxy/topology.go
@@ -153,6 +153,12 @@ func CategorizeEndpoints(endpoints []Endpoint, svcInfo ServicePort, nodeName str
 //     hinted for this node's zone, then it returns "PreferSameZone".
 //   - Otherwise it returns "" (meaning, no topology / default traffic distribution).
 func topologyModeFromHints(svcInfo ServicePort, endpoints []Endpoint, nodeName, zone string) string {
+	if len(endpoints) == 0 {
+		// The code below assumes at least 1 endpoint; if there are no endpoints,
+		// there are no hints.
+		return ""
+	}
+
 	hasEndpointForNode := false
 	allEndpointsHaveNodeHints := true
 	hasEndpointForZone := false
diff --git a/pkg/proxy/topology_test.go b/pkg/proxy/topology_test.go
index 807dc513d95..c5ef39dbbc6 100644
--- a/pkg/proxy/topology_test.go
+++ b/pkg/proxy/topology_test.go
@@ -390,6 +390,13 @@ func TestCategorizeEndpoints(t *testing.T) {
 		clusterEndpoints: nil,
 		localEndpoints:   sets.New[string]("10.0.0.1:80"),
 		allEndpoints:     sets.New[string]("10.0.0.1:80"),
+	}, {
+		name:             "empty cluster endpoints when no service endpoints exist",
+		serviceInfo:      &BaseServicePortInfo{},
+		endpoints:        nil,
+		clusterEndpoints: sets.New[string](),
+		localEndpoints:   nil,
+		allEndpoints:     nil,
 	}}
 
 	for _, tc := range testCases {