diff --git a/src/main/java/org/dependencytrack/persistence/NotificationQueryManager.java b/src/main/java/org/dependencytrack/persistence/NotificationQueryManager.java
index 48a070291..57f1284e8 100644
--- a/src/main/java/org/dependencytrack/persistence/NotificationQueryManager.java
+++ b/src/main/java/org/dependencytrack/persistence/NotificationQueryManager.java
@@ -249,11 +249,17 @@ public boolean bind(final NotificationRule notificationRule, final Collection<Ta
         return callInTransaction(() -> {
             boolean modified = false;
 
+            if (notificationRule.getTags() == null) {
+                notificationRule.setTags(new ArrayList<>());
+            }
+
             if (!keepExisting) {
                 for (final Tag existingTag : notificationRule.getTags()) {
                     if (!tags.contains(existingTag)) {
                         notificationRule.getTags().remove(existingTag);
-                        existingTag.getNotificationRules().remove(notificationRule);
+                        if (existingTag.getNotificationRules() != null) {
+                            existingTag.getNotificationRules().remove(notificationRule);
+                        }
                         modified = true;
                     }
                 }
diff --git a/src/main/java/org/dependencytrack/persistence/PolicyQueryManager.java b/src/main/java/org/dependencytrack/persistence/PolicyQueryManager.java
index 35337499d..b3beac6f0 100644
--- a/src/main/java/org/dependencytrack/persistence/PolicyQueryManager.java
+++ b/src/main/java/org/dependencytrack/persistence/PolicyQueryManager.java
@@ -841,11 +841,17 @@ public boolean bind(final Policy policy, final Collection<Tag> tags, final boole
         return callInTransaction(() -> {
             boolean modified = false;
 
+            if (policy.getTags() == null) {
+                policy.setTags(new ArrayList<>());
+            }
+
             if (!keepExisting) {
                 for (final Tag existingTag : policy.getTags()) {
                     if (!tags.contains(existingTag)) {
                         policy.getTags().remove(existingTag);
-                        existingTag.getPolicies().remove(policy);
+                        if (existingTag.getPolicies() != null) {
+                            existingTag.getPolicies().remove(policy);
+                        }
                         modified = true;
                     }
                 }
diff --git a/src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java b/src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java
index d1728caa4..2eeb1fedc 100644
--- a/src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java
+++ b/src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java
@@ -1382,11 +1382,17 @@ public boolean bind(final Project project, final Collection<Tag> tags, final boo
         return callInTransaction(() -> {
             boolean modified = false;
 
+            if (project.getTags() == null) {
+                project.setTags(new ArrayList<>());
+            }
+
             if (!keepExisting) {
                 for (final Tag existingTag : project.getTags()) {
                     if (!tags.contains(existingTag)) {
                         project.getTags().remove(existingTag);
-                        existingTag.getProjects().remove(project);
+                        if (existingTag.getProjects() != null) {
+                            existingTag.getProjects().remove(project);
+                        }
                         modified = true;
                     }
                 }
diff --git a/src/test/java/org/dependencytrack/resources/v1/ProjectResourceTest.java b/src/test/java/org/dependencytrack/resources/v1/ProjectResourceTest.java
index 850be551f..9db0cab97 100644
--- a/src/test/java/org/dependencytrack/resources/v1/ProjectResourceTest.java
+++ b/src/test/java/org/dependencytrack/resources/v1/ProjectResourceTest.java
@@ -475,14 +475,21 @@ public void getProjectByUnknownTagTest() {
 
     @Test
     public void createProjectTest(){
-        Project project = new Project();
-        project.setName("Acme Example");
-        project.setVersion("1.0");
-        project.setDescription("Test project");
         Response response = jersey.target(V1_PROJECT)
                 .request()
                 .header(X_API_KEY, apiKey)
-                .put(Entity.entity(project, MediaType.APPLICATION_JSON));
+                .put(Entity.json("""
+                        {
+                          "name": "Acme Example",
+                          "version": "1.0",
+                          "description": "Test project",
+                          "tags": [
+                            {
+                              "name": "foo"
+                            }
+                          ]
+                        }
+                        """));
         Assert.assertEquals(201, response.getStatus(), 0);
         JsonObject json = parseJsonObject(response);
         Assert.assertNotNull(json);
@@ -491,6 +498,8 @@ public void createProjectTest(){
         Assert.assertEquals("Test project", json.getString("description"));
         Assert.assertTrue(json.getBoolean("active"));
         Assert.assertTrue(UuidUtil.isValidUUID(json.getString("uuid")));
+        assertThat(json.getJsonArray("tags").getValuesAs(JsonObject.class)).satisfiesExactly(
+                jsonObject -> assertThat(jsonObject.getString("name")).isEqualTo("foo"));
     }
 
     @Test