diff --git a/backend/open_webui/routers/prompts.py b/backend/open_webui/routers/prompts.py
index 967d1b59ea..664fc892a7 100644
--- a/backend/open_webui/routers/prompts.py
+++ b/backend/open_webui/routers/prompts.py
@@ -7,7 +7,7 @@ from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL
 from open_webui.constants import ERROR_MESSAGES
 from open_webui.events import EVENTS, publish_event
 from open_webui.internal.db import get_async_session
-from open_webui.models.access_grants import AccessGrants
+from open_webui.models.access_grants import AccessGrants, normalize_access_grants
 from open_webui.models.config import Config
 from open_webui.models.groups import Groups
 from open_webui.models.prompt_history import (
@@ -289,13 +289,28 @@ async def update_prompt_by_id(
                 detail=ERROR_MESSAGES.COMMAND_TAKEN,
             )
 
-    form_data.access_grants = await filter_allowed_access_grants(
-        await Config.get('user.permissions'),
-        user.id,
-        user.role,
-        form_data.access_grants,
-        'sharing.public_prompts',
-    )
+    if form_data.access_grants is not None:
+        existing_access_grants = {
+            (grant.principal_type, grant.principal_id, grant.permission) for grant in prompt.access_grants
+        }
+        submitted_access_grants_map = {
+            (grant['principal_type'], grant['principal_id'], grant['permission']): grant
+            for grant in normalize_access_grants(form_data.access_grants)
+        }
+        preserved_access_grants = [
+            grant for key, grant in submitted_access_grants_map.items() if key in existing_access_grants
+        ]
+        new_access_grants = [
+            grant for key, grant in submitted_access_grants_map.items() if key not in existing_access_grants
+        ]
+
+        form_data.access_grants = preserved_access_grants + await filter_allowed_access_grants(
+            await Config.get('user.permissions'),
+            user.id,
+            user.role,
+            new_access_grants,
+            'sharing.public_prompts',
+        )
 
     # Use the ID from the found prompt
     updated_prompt = await Prompts.update_prompt_by_id(prompt.id, form_data, user.id, db=db)
diff --git a/backend/open_webui/routers/tools.py b/backend/open_webui/routers/tools.py
index 383d6669b1..19bc3fc67e 100644
--- a/backend/open_webui/routers/tools.py
+++ b/backend/open_webui/routers/tools.py
@@ -19,7 +19,7 @@ from open_webui.env import (
 )
 from open_webui.events import EVENTS, publish_event
 from open_webui.internal.db import get_async_session
-from open_webui.models.access_grants import AccessGrants
+from open_webui.models.access_grants import AccessGrants, normalize_access_grants
 from open_webui.models.config import Config
 from open_webui.models.groups import Groups
 from open_webui.models.oauth_sessions import OAuthSessions
@@ -571,12 +571,26 @@ async def _update_tool(request, id, form_data, user, db, version_id=None):
 
         specs = get_local_tool_specs(tool_module)
 
-        if version_id is None:
-            form_data.access_grants = await filter_allowed_access_grants(
+        if version_id is None and form_data.access_grants is not None:
+            existing_access_grants = {
+                (grant.principal_type, grant.principal_id, grant.permission) for grant in tools.access_grants
+            }
+            submitted_access_grants_map = {
+                (grant['principal_type'], grant['principal_id'], grant['permission']): grant
+                for grant in normalize_access_grants(form_data.access_grants)
+            }
+            preserved_access_grants = [
+                grant for key, grant in submitted_access_grants_map.items() if key in existing_access_grants
+            ]
+            new_access_grants = [
+                grant for key, grant in submitted_access_grants_map.items() if key not in existing_access_grants
+            ]
+
+            form_data.access_grants = preserved_access_grants + await filter_allowed_access_grants(
                 await Config.get('user.permissions'),
                 user.id,
                 user.role,
-                form_data.access_grants,
+                new_access_grants,
                 'sharing.public_tools',
             )