diff --git a/pkgs/racket-doc/scribblings/foreign/file.scrbl b/pkgs/racket-doc/scribblings/foreign/file.scrbl
index 5662c247b7..30f80ffc48 100644
--- a/pkgs/racket-doc/scribblings/foreign/file.scrbl
+++ b/pkgs/racket-doc/scribblings/foreign/file.scrbl
@@ -56,8 +56,8 @@ the same as for @racket[security-guard-check-file].
 
 @defproc[(security-guard-check-network
            [who symbol?]
-           [host string?]
-           [port (integer-in 1 65535)]
+           [host (or/c string? #f)]
+           [port (or/c (integer-in 1 65535) #f)]
            [mode (or/c 'client 'server)])
          void?]{
 
diff --git a/pkgs/racket-test-core/tests/racket/file.rktl b/pkgs/racket-test-core/tests/racket/file.rktl
index 9d21d5ed59..2d43c888e9 100644
--- a/pkgs/racket-test-core/tests/racket/file.rktl
+++ b/pkgs/racket-test-core/tests/racket/file.rktl
@@ -2122,7 +2122,9 @@
     (sc-run #t #:check security-guard-check-network
             "localhost" 500 'client)
     (sc-run #t #:check security-guard-check-network
-            "localhost" 500 'server))
+            "localhost" 500 'server)
+    (sc-run #t #:check security-guard-check-network
+            #f #f 'server))
 
   (parameterize ((current-security-guard sg-ro))
     (sc-run #t "foo.txt" '(read))
@@ -2138,7 +2140,9 @@
     (sc-run #t #:check security-guard-check-network
             "localhost" 500 'client)
     (sc-run #f #:check security-guard-check-network
-            "localhost" 500 'server))
+            "localhost" 500 'server)
+    (sc-run #f #:check security-guard-check-network
+            #f #f 'server))
 
   (parameterize ((current-security-guard sg-priv))
     (sc-run #t pub-mod '(read))
diff --git a/racket/src/bc/src/thread.c b/racket/src/bc/src/thread.c
index c74834bc35..b18e6448f9 100644
--- a/racket/src/bc/src/thread.c
+++ b/racket/src/bc/src/thread.c
@@ -8589,22 +8589,26 @@ static Scheme_Object *security_guard_check_network(int argc, Scheme_Object *argv
   if (!SCHEME_SYMBOLP(argv[0]))
     scheme_wrong_contract("security-guard-check-network", "symbol?", 0, argc, argv);
 
-  if (!SCHEME_CHAR_STRINGP(argv[1]))
-    scheme_wrong_contract("security-guard-check-network", "string?", 1, argc, argv);
+  if (SCHEME_TRUEP(argv[1]) && !SCHEME_CHAR_STRINGP(argv[1]))
+    scheme_wrong_contract("security-guard-check-network", "(or/c string? #f)", 1, argc, argv);
 
-  if (!SCHEME_INTP(argv[2])
-      || (SCHEME_INT_VAL(argv[2]) < 1)
-      || (SCHEME_INT_VAL(argv[2]) > 65535))
-    scheme_wrong_contract("security-guard-check-network", "(integer-in 1 65535)", 2, argc, argv);
+  if (SCHEME_TRUEP(argv[2])
+      && (!SCHEME_INTP(argv[2])
+          || (SCHEME_INT_VAL(argv[2]) < 1)
+          || (SCHEME_INT_VAL(argv[2]) > 65535)))
+    scheme_wrong_contract("security-guard-check-network", "(or/c (integer-in 1 65535) #f)", 2, argc, argv);
   
   if (!SAME_OBJ(argv[3], client_symbol) && !SAME_OBJ(argv[3], server_symbol))
     scheme_wrong_contract("security-guard-check-network", "(or/c 'client'server)", 3, argc, argv);
 
-  a = scheme_char_string_to_byte_string(argv[1]);
+  if (SCHEME_TRUEP(argv[1]))
+    a = scheme_char_string_to_byte_string(argv[1]);
+  else
+    a = NULL;
   
   scheme_security_check_network(scheme_symbol_val(argv[0]),
-                                SCHEME_BYTE_STR_VAL(a),
-                                SCHEME_INT_VAL(argv[2]),
+                                a ? SCHEME_BYTE_STR_VAL(a) : NULL,
+                                SCHEME_TRUEP(argv[2]) ? SCHEME_INT_VAL(argv[2]) : 0,
                                 SAME_OBJ(argv[3], client_symbol));
 
   return scheme_void;