diff --git a/server/datastore/mysql/policies.go b/server/datastore/mysql/policies.go
index 90aad55bf0..ba57f1578c 100644
--- a/server/datastore/mysql/policies.go
+++ b/server/datastore/mysql/policies.go
@@ -454,7 +454,7 @@ func (ds *Datastore) CountPolicies(ctx context.Context, teamID *uint, matchQuery
 func (ds *Datastore) CountMergedTeamPolicies(ctx context.Context, teamID uint, matchQuery string) (int, error) {
 	var args []interface{}
 
-	query := `SELECT count(*) FROM policies p WHERE p.team_id = ? OR p.team_id IS NULL`
+	query := `SELECT count(*) FROM policies p WHERE (p.team_id = ? OR p.team_id IS NULL)`
 	args = append(args, teamID)
 
 	// We must normalize the name for full Unicode support (Unicode equivalence).
diff --git a/server/datastore/mysql/policies_test.go b/server/datastore/mysql/policies_test.go
index 97c5e1393d..f4c3ddfdf0 100644
--- a/server/datastore/mysql/policies_test.go
+++ b/server/datastore/mysql/policies_test.go
@@ -3058,6 +3058,19 @@ func testCountPolicies(t *testing.T, ds *Datastore) {
 	mergedCount, err = ds.CountMergedTeamPolicies(ctx, tm.ID, "")
 	require.NoError(t, err)
 	assert.Equal(t, 15, mergedCount)
+
+	// test filter
+	globalCount, err = ds.CountPolicies(ctx, nil, "global policy 1")
+	require.NoError(t, err)
+	assert.Equal(t, 1, globalCount)
+
+	teamCount, err = ds.CountPolicies(ctx, &tm.ID, "team policy 1")
+	require.NoError(t, err)
+	assert.Equal(t, 1, teamCount)
+
+	mergedCount, err = ds.CountMergedTeamPolicies(ctx, tm.ID, "policy 1")
+	require.NoError(t, err)
+	assert.Equal(t, 2, mergedCount)
 }
 
 func testUpdatePolicyHostCounts(t *testing.T, ds *Datastore) {