diff --git a/client/internal/engine.go b/client/internal/engine.go
index 980326720..fa0516d4f 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -914,15 +914,17 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		// todo update signal
 	}
 
-	if err := e.updateChecksIfNew(update.Checks); err != nil {
-		return err
-	}
-
 	nm := update.GetNetworkMap()
 	if nm == nil {
+		// config-only update (e.g. relay token rotation): posture checks and network map are intentionally absent,
+		// preserving the previously applied state
 		return nil
 	}
 
+	if err := e.updateChecksIfNew(update.Checks); err != nil {
+		return err
+	}
+
 	// Persist sync response under the dedicated lock (syncRespMux), not under syncMsgMux.
 	// A non-nil syncStore is what marks persistence as enabled. Hold the lock for
 	// the whole Set so the store cannot be cleared (disabled / engine close)