diff --git a/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/reactive/EndpointRequest.java b/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/reactive/EndpointRequest.java
index bed3b8f5c0..6b0739d2a7 100644
--- a/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/reactive/EndpointRequest.java
+++ b/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/reactive/EndpointRequest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2024 the original author or authors.
+ * Copyright 2012-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -217,11 +217,18 @@ public final class EndpointRequest {
 			if (this.includeLinks && StringUtils.hasText(pathMappedEndpoints.getBasePath())) {
 				delegateMatchers.add(new LinksServerWebExchangeMatcher());
 			}
+			if (delegateMatchers.isEmpty()) {
+				return EMPTY_MATCHER;
+			}
 			return new OrServerWebExchangeMatcher(delegateMatchers);
 		}
 
 		private Stream<String> streamPaths(List<Object> source, PathMappedEndpoints pathMappedEndpoints) {
-			return source.stream().filter(Objects::nonNull).map(this::getEndpointId).map(pathMappedEndpoints::getPath);
+			return source.stream()
+				.filter(Objects::nonNull)
+				.map(this::getEndpointId)
+				.map(pathMappedEndpoints::getPath)
+				.filter(Objects::nonNull);
 		}
 
 		@Override
@@ -234,6 +241,7 @@ public final class EndpointRequest {
 		}
 
 		private PathPatternParserServerWebExchangeMatcher getDelegateMatcher(String path) {
+			Assert.notNull(path, "'path' must not be null");
 			return new PathPatternParserServerWebExchangeMatcher(path + "/**");
 		}
 
diff --git a/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java b/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java
index b8a63d0c4c..f53e8de07c 100644
--- a/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java
+++ b/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2024 the original author or authors.
+ * Copyright 2012-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -241,11 +241,18 @@ public final class EndpointRequest {
 			if (this.includeLinks && StringUtils.hasText(basePath)) {
 				delegateMatchers.addAll(getLinksMatchers(requestMatcherFactory, matcherProvider, basePath));
 			}
+			if (delegateMatchers.isEmpty()) {
+				return EMPTY_MATCHER;
+			}
 			return new OrRequestMatcher(delegateMatchers);
 		}
 
 		private Stream<String> streamPaths(List<Object> source, PathMappedEndpoints pathMappedEndpoints) {
-			return source.stream().filter(Objects::nonNull).map(this::getEndpointId).map(pathMappedEndpoints::getPath);
+			return source.stream()
+				.filter(Objects::nonNull)
+				.map(this::getEndpointId)
+				.map(pathMappedEndpoints::getPath)
+				.filter(Objects::nonNull);
 		}
 
 		private List<RequestMatcher> getDelegateMatchers(RequestMatcherFactory requestMatcherFactory,
@@ -316,6 +323,7 @@ public final class EndpointRequest {
 		RequestMatcher antPath(RequestMatcherProvider matcherProvider, String... parts) {
 			StringBuilder pattern = new StringBuilder();
 			for (String part : parts) {
+				Assert.notNull(part, "'part' must not be null");
 				pattern.append(part);
 			}
 			return matcherProvider.getRequestMatcher(pattern.toString());