diff --git a/src/core/settings/nm-agent-manager.c b/src/core/settings/nm-agent-manager.c
index 19b3cfcbaf..3c1cc50253 100644
--- a/src/core/settings/nm-agent-manager.c
+++ b/src/core/settings/nm-agent-manager.c
@@ -1130,7 +1130,7 @@ _con_get_request_start(Request *req)
             perm = NM_AUTH_PERMISSION_SETTINGS_MODIFY_SYSTEM;
         nm_auth_chain_set_data(req->con.chain, "perm", (gpointer) perm, NULL);
 
-        nm_auth_chain_add_call_unsafe(req->con.chain, perm, TRUE);
+        nm_auth_chain_add_call_unsafe(req->con.chain, perm, !!req->con.get.existing_secrets);
     } else {
         _LOGD(NULL,
               "(" LOG_REQ_FMT ") requesting user-owned secrets from agent %s",
diff --git a/src/core/settings/nm-settings-connection.c b/src/core/settings/nm-settings-connection.c
index d5611e7640..7effda217d 100644
--- a/src/core/settings/nm-settings-connection.c
+++ b/src/core/settings/nm-settings-connection.c
@@ -781,7 +781,7 @@ validate_secret_flags(NMConnection *connection, GVariant *secrets, ForEachSecret
 static gboolean
 secret_is_system_owned(NMSettingSecretFlags flags, gpointer user_data)
 {
-    return !NM_FLAGS_HAS(flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED);
+    return !NM_FLAGS_HAS(flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED) && !NM_FLAGS_HAS(flags, NM_SETTING_SECRET_FLAG_NOT_SAVED);
 }
 
 static void