diff --git a/xds/src/main/java/io/grpc/xds/ClientXdsClient.java b/xds/src/main/java/io/grpc/xds/ClientXdsClient.java
index 3bef4c416e0..f39992c24ac 100644
--- a/xds/src/main/java/io/grpc/xds/ClientXdsClient.java
+++ b/xds/src/main/java/io/grpc/xds/ClientXdsClient.java
@@ -138,8 +138,8 @@ final class ClientXdsClient extends AbstractXdsClient {
           || Boolean.parseBoolean(System.getenv("GRPC_XDS_EXPERIMENTAL_ENABLE_RETRY"));
   @VisibleForTesting
   static boolean enableRbac =
-      Strings.isNullOrEmpty(System.getenv("GRPC_XDS_EXPERIMENTAL_RBAC"))
-          || Boolean.parseBoolean(System.getenv("GRPC_XDS_EXPERIMENTAL_RBAC"));
+      !Strings.isNullOrEmpty(System.getenv("GRPC_XDS_EXPERIMENTAL_RBAC"))
+          && Boolean.parseBoolean(System.getenv("GRPC_XDS_EXPERIMENTAL_RBAC"));
 
   private static final String TYPE_URL_HTTP_CONNECTION_MANAGER_V2 =
       "type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2"
@@ -222,7 +222,7 @@ protected void handleLdsResponse(String versionInfo, List<Any> resources, String
               listener, retainedRdsResources, enableFaultInjection && isResourceV3);
         } else {
           ldsUpdate = processServerSideListener(
-              listener, retainedRdsResources, enableRbac);
+              listener, retainedRdsResources, enableRbac && isResourceV3);
         }
       } catch (ResourceInvalidException e) {
         errors.add(
diff --git a/xds/src/main/java/io/grpc/xds/XdsServerWrapper.java b/xds/src/main/java/io/grpc/xds/XdsServerWrapper.java
index fdc5f099bfe..5f7cc43d670 100644
--- a/xds/src/main/java/io/grpc/xds/XdsServerWrapper.java
+++ b/xds/src/main/java/io/grpc/xds/XdsServerWrapper.java
@@ -515,20 +515,22 @@ private ImmutableMap<Route, ServerInterceptor> generatePerRouteInterceptors(
           Map<String, FilterConfig> selectedOverrideConfigs =
               new HashMap<>(virtualHost.filterConfigOverrides());
           selectedOverrideConfigs.putAll(route.filterConfigOverrides());
-          for (NamedFilterConfig namedFilterConfig : namedFilterConfigs) {
-            FilterConfig filterConfig = namedFilterConfig.filterConfig;
-            Filter filter = filterRegistry.get(filterConfig.typeUrl());
-            if (filter instanceof ServerInterceptorBuilder) {
-              ServerInterceptor interceptor =
-                  ((ServerInterceptorBuilder) filter).buildServerInterceptor(
-                      filterConfig, selectedOverrideConfigs.get(namedFilterConfig.name));
-              if (interceptor != null) {
-                filterInterceptors.add(interceptor);
+          if (namedFilterConfigs != null) {
+            for (NamedFilterConfig namedFilterConfig : namedFilterConfigs) {
+              FilterConfig filterConfig = namedFilterConfig.filterConfig;
+              Filter filter = filterRegistry.get(filterConfig.typeUrl());
+              if (filter instanceof ServerInterceptorBuilder) {
+                ServerInterceptor interceptor =
+                    ((ServerInterceptorBuilder) filter).buildServerInterceptor(
+                        filterConfig, selectedOverrideConfigs.get(namedFilterConfig.name));
+                if (interceptor != null) {
+                  filterInterceptors.add(interceptor);
+                }
+              } else {
+                logger.log(Level.WARNING, "HttpFilterConfig(type URL: "
+                    + filterConfig.typeUrl() + ") is not supported on server-side. "
+                    + "Probably a bug at ClientXdsClient verification.");
               }
-            } else {
-              logger.log(Level.WARNING, "HttpFilterConfig(type URL: "
-                  + filterConfig.typeUrl() + ") is not supported on server-side. "
-                  + "Probably a bug at ClientXdsClient verification.");
             }
           }
           ServerInterceptor interceptor = combineInterceptors(filterInterceptors);
diff --git a/xds/src/test/java/io/grpc/xds/ClientXdsClientDataTest.java b/xds/src/test/java/io/grpc/xds/ClientXdsClientDataTest.java
index 597ca7df2d9..17ca907da42 100644
--- a/xds/src/test/java/io/grpc/xds/ClientXdsClientDataTest.java
+++ b/xds/src/test/java/io/grpc/xds/ClientXdsClientDataTest.java
@@ -138,7 +138,8 @@ public void setUp() {
     originalEnableRetry = ClientXdsClient.enableRetry;
     assertThat(originalEnableRetry).isTrue();
     originalEnableRbac = ClientXdsClient.enableRbac;
-    assertThat(originalEnableRbac).isTrue();
+    assertThat(originalEnableRbac).isFalse();
+    ClientXdsClient.enableRbac = true;
   }
 
   @After
diff --git a/xds/src/test/java/io/grpc/xds/ClientXdsClientTestBase.java b/xds/src/test/java/io/grpc/xds/ClientXdsClientTestBase.java
index e66c73163be..3a9ab23aa74 100644
--- a/xds/src/test/java/io/grpc/xds/ClientXdsClientTestBase.java
+++ b/xds/src/test/java/io/grpc/xds/ClientXdsClientTestBase.java
@@ -246,6 +246,7 @@ public long currentTimeNanos() {
   private ManagedChannel channel;
   private ClientXdsClient xdsClient;
   private boolean originalEnableFaultInjection;
+  private boolean originalEnableRbac;
 
   @Before
   public void setUp() throws IOException {
@@ -258,6 +259,9 @@ public void setUp() throws IOException {
     // Start the server and the client.
     originalEnableFaultInjection = ClientXdsClient.enableFaultInjection;
     ClientXdsClient.enableFaultInjection = true;
+    originalEnableRbac = ClientXdsClient.enableRbac;
+    assertThat(originalEnableRbac).isFalse();
+    ClientXdsClient.enableRbac = true;
     final String serverName = InProcessServerBuilder.generateName();
     cleanupRule.register(
         InProcessServerBuilder
@@ -297,6 +301,7 @@ public void setUp() throws IOException {
   @After
   public void tearDown() {
     ClientXdsClient.enableFaultInjection = originalEnableFaultInjection;
+    ClientXdsClient.enableRbac = originalEnableRbac;
     xdsClient.shutdown();
     channel.shutdown();  // channel not owned by XdsClient
     assertThat(adsEnded.get()).isTrue();