diff --git a/libnm-util/nm-setting-vpn.c b/libnm-util/nm-setting-vpn.c
index aa064f3152..3b33f3c8ad 100644
--- a/libnm-util/nm-setting-vpn.c
+++ b/libnm-util/nm-setting-vpn.c
@@ -295,6 +295,7 @@ update_one_secret (NMSetting *setting, const char *key, GValue *value, GError **
 static gboolean
 get_secret_flags (NMSetting *setting,
                   const char *secret_name,
+                  gboolean verify_secret,
                   NMSettingSecretFlags *out_flags,
                   GError **error)
 {
@@ -331,6 +332,7 @@ get_secret_flags (NMSetting *setting,
 static gboolean
 set_secret_flags (NMSetting *setting,
                   const char *secret_name,
+                  gboolean verify_secret,
                   NMSettingSecretFlags flags,
                   GError **error)
 {
diff --git a/libnm-util/nm-setting-wireless-security.c b/libnm-util/nm-setting-wireless-security.c
index b31f85ad5f..a0ffdddddd 100644
--- a/libnm-util/nm-setting-wireless-security.c
+++ b/libnm-util/nm-setting-wireless-security.c
@@ -828,6 +828,58 @@ verify (NMSetting *setting, GSList *all_settings, GError **error)
 	return TRUE;
 }
 
+static gboolean
+get_secret_flags (NMSetting *setting,
+                  const char *secret_name,
+                  gboolean verify_secret,
+                  NMSettingSecretFlags *out_flags,
+                  GError **error)
+{
+	NMSettingClass *setting_class;
+	gboolean verify_override = verify_secret;
+
+	/* There's only one 'flags' property for WEP keys, so alias all the WEP key
+	 * property names to that flags property.
+	 */
+	if (   !g_strcmp0 (secret_name, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0)
+	    || !g_strcmp0 (secret_name, NM_SETTING_WIRELESS_SECURITY_WEP_KEY1)
+	    || !g_strcmp0 (secret_name, NM_SETTING_WIRELESS_SECURITY_WEP_KEY2)
+	    || !g_strcmp0 (secret_name, NM_SETTING_WIRELESS_SECURITY_WEP_KEY3)) {
+		secret_name = "wep-key";
+		verify_override = FALSE; /* Already know it's a secret */
+	}
+
+	/* Chain up to superclass with modified key name */
+	setting_class = NM_SETTING_CLASS (nm_setting_wireless_security_parent_class);
+	return setting_class->get_secret_flags (setting, secret_name, verify_override, out_flags, error);
+}
+
+static gboolean
+set_secret_flags (NMSetting *setting,
+                  const char *secret_name,
+                  gboolean verify_secret,
+                  NMSettingSecretFlags flags,
+                  GError **error)
+{
+	NMSettingClass *setting_class;
+	gboolean verify_override = verify_secret;
+
+	/* There's only one 'flags' property for WEP keys, so alias all the WEP key
+	 * property names to that flags property.
+	 */
+	if (   !g_strcmp0 (secret_name, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0)
+	    || !g_strcmp0 (secret_name, NM_SETTING_WIRELESS_SECURITY_WEP_KEY1)
+	    || !g_strcmp0 (secret_name, NM_SETTING_WIRELESS_SECURITY_WEP_KEY2)
+	    || !g_strcmp0 (secret_name, NM_SETTING_WIRELESS_SECURITY_WEP_KEY3)) {
+		secret_name = "wep-key";
+		verify_override = FALSE; /* Already know it's a secret */
+	}
+
+	/* Chain up to superclass with modified key name */
+	setting_class = NM_SETTING_CLASS (nm_setting_wireless_security_parent_class);
+	return setting_class->set_secret_flags (setting, secret_name, verify_override, flags, error);
+}
+
 static void
 nm_setting_wireless_security_init (NMSettingWirelessSecurity *setting)
 {
@@ -1013,8 +1065,10 @@ nm_setting_wireless_security_class_init (NMSettingWirelessSecurityClass *setting
 	object_class->get_property = get_property;
 	object_class->finalize     = finalize;
 
-	parent_class->verify         = verify;
-	parent_class->need_secrets   = need_secrets;
+	parent_class->verify           = verify;
+	parent_class->need_secrets     = need_secrets;
+	parent_class->get_secret_flags = get_secret_flags;
+	parent_class->set_secret_flags = set_secret_flags;
 
 	/* Properties */
 	/**
diff --git a/libnm-util/nm-setting.c b/libnm-util/nm-setting.c
index 31d9c9d186..5e1614c910 100644
--- a/libnm-util/nm-setting.c
+++ b/libnm-util/nm-setting.c
@@ -598,13 +598,15 @@ is_secret_prop (NMSetting *setting, const char *secret_name, GError **error)
 static gboolean
 get_secret_flags (NMSetting *setting,
                   const char *secret_name,
+                  gboolean verify_secret,
                   NMSettingSecretFlags *out_flags,
                   GError **error)
 {
 	char *flags_prop;
 	NMSettingSecretFlags flags = NM_SETTING_SECRET_FLAG_SYSTEM_OWNED;
 
-	g_return_val_if_fail (is_secret_prop (setting, secret_name, error), FALSE);
+	if (verify_secret)
+		g_return_val_if_fail (is_secret_prop (setting, secret_name, error), FALSE);
 
 	flags_prop = g_strdup_printf ("%s-flags", secret_name);
 	g_object_get (G_OBJECT (setting), flags_prop, &flags, NULL);
@@ -638,18 +640,20 @@ nm_setting_get_secret_flags (NMSetting *setting,
 	g_return_val_if_fail (NM_IS_SETTING (setting), FALSE);
 	g_return_val_if_fail (secret_name != NULL, FALSE);
 
-	return NM_SETTING_GET_CLASS (setting)->get_secret_flags (setting, secret_name, out_flags, error);
+	return NM_SETTING_GET_CLASS (setting)->get_secret_flags (setting, secret_name, TRUE, out_flags, error);
 }
 
 static gboolean
 set_secret_flags (NMSetting *setting,
                   const char *secret_name,
+                  gboolean verify_secret,
                   NMSettingSecretFlags flags,
                   GError **error)
 {
 	char *flags_prop;
 
-	g_return_val_if_fail (is_secret_prop (setting, secret_name, error), FALSE);
+	if (verify_secret)
+		g_return_val_if_fail (is_secret_prop (setting, secret_name, error), FALSE);
 
 	flags_prop = g_strdup_printf ("%s-flags", secret_name);
 	g_object_set (G_OBJECT (setting), flags_prop, flags, NULL);
@@ -681,7 +685,7 @@ nm_setting_set_secret_flags (NMSetting *setting,
 	g_return_val_if_fail (secret_name != NULL, FALSE);
 	g_return_val_if_fail (flags & NM_SETTING_SECRET_FLAGS_ALL, FALSE);
 
-	return NM_SETTING_GET_CLASS (setting)->set_secret_flags (setting, secret_name, flags, error);
+	return NM_SETTING_GET_CLASS (setting)->set_secret_flags (setting, secret_name, TRUE, flags, error);
 }
 
 /**
diff --git a/libnm-util/nm-setting.h b/libnm-util/nm-setting.h
index bf2c63f00e..bb5de530cc 100644
--- a/libnm-util/nm-setting.h
+++ b/libnm-util/nm-setting.h
@@ -133,11 +133,13 @@ typedef struct {
 
 	gboolean    (*get_secret_flags)  (NMSetting  *setting,
 	                                  const char *secret_name,
+	                                  gboolean verify_secret,
 	                                  NMSettingSecretFlags *out_flags,
 	                                  GError **error);
 
 	gboolean    (*set_secret_flags)  (NMSetting  *setting,
 	                                  const char *secret_name,
+	                                  gboolean verify_secret,
 	                                  NMSettingSecretFlags flags,
 	                                  GError **error);