diff --git a/clients/tui/nm-editor-bindings.c b/clients/tui/nm-editor-bindings.c
index 647ac8df17..24803868e5 100644
--- a/clients/tui/nm-editor-bindings.c
+++ b/clients/tui/nm-editor-bindings.c
@@ -585,9 +585,6 @@ get_security_type (NMEditorWirelessSecurityMethodBinding *binding)
 		return "none";
 
 	key_mgmt = nm_setting_wireless_security_get_key_mgmt (binding->s_wsec);
-	if (!key_mgmt)
-		return "none";
-
 	auth_alg = nm_setting_wireless_security_get_auth_alg (binding->s_wsec);
 
 	/* No IEEE 802.1x */
diff --git a/clients/tui/nmt-page-wifi.c b/clients/tui/nmt-page-wifi.c
index f846345c69..35625fe4c7 100644
--- a/clients/tui/nmt-page-wifi.c
+++ b/clients/tui/nmt-page-wifi.c
@@ -38,6 +38,13 @@
 
 G_DEFINE_TYPE (NmtPageWifi, nmt_page_wifi, NMT_TYPE_EDITOR_PAGE_DEVICE)
 
+#define NMT_PAGE_WIFI_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), NMT_TYPE_PAGE_WIFI, NmtPageWifiPrivate))
+
+typedef struct {
+	NMSettingWirelessSecurity *s_wsec;
+
+} NmtPageWifiPrivate;
+
 NmtEditorPage *
 nmt_page_wifi_new (NMConnection   *conn,
                    NmtDeviceEntry *deventry)
@@ -170,6 +177,7 @@ ssid_transform_from_entry (GBinding     *binding,
 static void
 nmt_page_wifi_constructed (GObject *object)
 {
+	NmtPageWifiPrivate *priv = NMT_PAGE_WIFI_GET_PRIVATE (object);
 	NmtPageWifi *wifi = NMT_PAGE_WIFI (object);
 	NmtDeviceEntry *deventry;
 	NmtEditorSection *section;
@@ -190,9 +198,13 @@ nmt_page_wifi_constructed (GObject *object)
 
 	s_wsec = nm_connection_get_setting_wireless_security (conn);
 	if (!s_wsec) {
-		nm_connection_add_setting (conn, nm_setting_wireless_security_new ());
-		s_wsec = nm_connection_get_setting_wireless_security (conn);
+		/* It makes things simpler if we always have a
+		 * NMSettingWirelessSecurity; we'll hold a ref on one, and add
+		 * it to and remove it from the connection as needed.
+		 */
+		s_wsec = NM_SETTING_WIRELESS_SECURITY (nm_setting_wireless_security_new ());
 	}
+	priv->s_wsec = g_object_ref_sink (s_wsec);
 
 	deventry = nmt_editor_page_device_get_device_entry (NMT_EDITOR_PAGE_DEVICE (object));
 	g_object_bind_property (s_wireless, NM_SETTING_WIRELESS_MAC_ADDRESS,
@@ -362,10 +374,24 @@ nmt_page_wifi_constructed (GObject *object)
 	G_OBJECT_CLASS (nmt_page_wifi_parent_class)->constructed (object);
 }
 
+static void
+nmt_page_wifi_finalize (GObject *object)
+{
+	NmtPageWifiPrivate *priv = NMT_PAGE_WIFI_GET_PRIVATE (object);
+
+	g_clear_object (&priv->s_wsec);
+
+	G_OBJECT_CLASS (nmt_page_wifi_parent_class)->finalize (object);
+}
+
+
 static void
 nmt_page_wifi_class_init (NmtPageWifiClass *wifi_class)
 {
 	GObjectClass *object_class = G_OBJECT_CLASS (wifi_class);
 
+	g_type_class_add_private (wifi_class, sizeof (NmtPageWifiPrivate));
+
 	object_class->constructed = nmt_page_wifi_constructed;
+	object_class->finalize    = nmt_page_wifi_finalize;
 }