diff --git a/.changelog/15272.txt b/.changelog/15272.txt
new file mode 100644
index 000000000..0dffd91cb
--- /dev/null
+++ b/.changelog/15272.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+proxycfg(mesh-gateway): Fix issue where deregistered services are not removed from mesh-gateway clusters.
+```
diff --git a/agent/proxycfg/mesh_gateway.go b/agent/proxycfg/mesh_gateway.go
index dbfddc64c..3c518dbd8 100644
--- a/agent/proxycfg/mesh_gateway.go
+++ b/agent/proxycfg/mesh_gateway.go
@@ -258,6 +258,9 @@ func (s *handlerMeshGateway) handleUpdate(ctx context.Context, u UpdateEvent, sn
 				//                 Do those endpoints get cleaned up some other way?
 				delete(snap.MeshGateway.WatchedServices, sid)
 				cancelFn()
+
+				// always remove the sid from the ServiceGroups when un-watch the service
+				delete(snap.MeshGateway.ServiceGroups, sid)
 			}
 		}
 		snap.MeshGateway.WatchedServicesSet = true
diff --git a/agent/proxycfg/snapshot.go b/agent/proxycfg/snapshot.go
index 86875151d..be9fb251e 100644
--- a/agent/proxycfg/snapshot.go
+++ b/agent/proxycfg/snapshot.go
@@ -482,6 +482,10 @@ func (c *ConfigSnapshot) MeshGatewayValidExportedServices() []structs.ServiceNam
 			continue // not possible
 		}
 
+		if _, ok := c.MeshGateway.ServiceGroups[svc]; !ok {
+			continue // unregistered services
+		}
+
 		chain, ok := c.MeshGateway.DiscoveryChain[svc]
 		if !ok {
 			continue // ignore; not ready