diff --git a/src/libnm-gtk/nm-ui-utils.c b/src/libnm-gtk/nm-ui-utils.c
index df2301d..edd1ff4 100644
--- a/src/libnm-gtk/nm-ui-utils.c
+++ b/src/libnm-gtk/nm-ui-utils.c
@@ -864,8 +864,10 @@ nma_utils_setup_password_storage (GtkWidget *passwd_entry,
 	gtk_menu_attach_to_widget (GTK_MENU (popup_menu), passwd_entry, NULL);
 
 	/* Initialize active item for password-storage popup menu */
-	if (setting && password_flags_name)
-		nm_setting_get_secret_flags (setting, password_flags_name, &secret_flags, NULL);
+	if (setting && password_flags_name) {
+		if (!nm_setting_get_secret_flags (setting, password_flags_name, &secret_flags, NULL))
+			secret_flags = initial_flags;
+	}
 	else
 		secret_flags = initial_flags;
 
diff --git a/src/wireless-security/eap-method-leap.c b/src/wireless-security/eap-method-leap.c
index 565c68a..e52b23f 100644
--- a/src/wireless-security/eap-method-leap.c
+++ b/src/wireless-security/eap-method-leap.c
@@ -238,7 +238,7 @@ eap_method_leap_new (WirelessSecurity *ws_parent,
 	/* Create password-storage popup menu for password entry under entry's secondary icon */
 	if (connection)
 		s_8021x = nm_connection_get_setting_802_1x (connection);
-	nma_utils_setup_password_storage (widget, 0, (NMSetting *) s_8021x, parent->password_flags_name,
+	nma_utils_setup_password_storage (widget, NM_SETTING_SECRET_FLAG_AGENT_OWNED, (NMSetting *) s_8021x, parent->password_flags_name,
 	                                  FALSE, secrets_only);
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "show_checkbutton_eapleap"));
diff --git a/src/wireless-security/eap-method-simple.c b/src/wireless-security/eap-method-simple.c
index bffe179..a2156fa 100644
--- a/src/wireless-security/eap-method-simple.c
+++ b/src/wireless-security/eap-method-simple.c
@@ -343,7 +343,7 @@ eap_method_simple_new (WirelessSecurity *ws_parent,
 	/* Create password-storage popup menu for password entry under entry's secondary icon */
 	if (connection)
 		s_8021x = nm_connection_get_setting_802_1x (connection);
-	nma_utils_setup_password_storage (widget, 0, (NMSetting *) s_8021x, parent->password_flags_name,
+	nma_utils_setup_password_storage (widget, NM_SETTING_SECRET_FLAG_AGENT_OWNED, (NMSetting *) s_8021x, parent->password_flags_name,
 	                                  FALSE, flags & EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY);
 
 	g_signal_connect (method->password_entry, "notify::secondary-icon-name",
diff --git a/src/wireless-security/eap-method-tls.c b/src/wireless-security/eap-method-tls.c
index 815e6a8..3e64570 100644
--- a/src/wireless-security/eap-method-tls.c
+++ b/src/wireless-security/eap-method-tls.c
@@ -584,7 +584,7 @@ eap_method_tls_new (WirelessSecurity *ws_parent,
 	                  ws_parent);
 
 	/* Create password-storage popup menu for password entry under entry's secondary icon */
-	nma_utils_setup_password_storage (widget, 0, (NMSetting *) s_8021x, parent->password_flags_name,
+	nma_utils_setup_password_storage (widget, NM_SETTING_SECRET_FLAG_AGENT_OWNED, (NMSetting *) s_8021x, parent->password_flags_name,
 	                                  FALSE, secrets_only);
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "show_checkbutton_eaptls"));
diff --git a/src/wireless-security/wireless-security.c b/src/wireless-security/wireless-security.c
index 17eaab5..ffbb931 100644
--- a/src/wireless-security/wireless-security.c
+++ b/src/wireless-security/wireless-security.c
@@ -551,8 +551,10 @@ ws_802_1x_fill_connection (WirelessSecurity *sec,
 
 	/* Get previous pasword flags, if any. Otherwise default to agent-owned secrets */
 	s_8021x = nm_connection_get_setting_802_1x (connection);
-	if (s_8021x)
-		nm_setting_get_secret_flags (NM_SETTING (s_8021x), eap->password_flags_name, &secret_flags, NULL);
+	if (s_8021x) {
+		if (!nm_setting_get_secret_flags (NM_SETTING (s_8021x), eap->password_flags_name, &secret_flags, NULL))
+			secret_flags = NM_SETTING_SECRET_FLAG_AGENT_OWNED;
+	}
 	else
 		secret_flags = NM_SETTING_SECRET_FLAG_AGENT_OWNED;
 
diff --git a/src/wireless-security/ws-leap.c b/src/wireless-security/ws-leap.c
index 0ca97b2..9cee65d 100644
--- a/src/wireless-security/ws-leap.c
+++ b/src/wireless-security/ws-leap.c
@@ -179,7 +179,7 @@ ws_leap_new (NMConnection *connection, gboolean secrets_only)
 	                  sec);
 
 	/* Create password-storage popup menu for password entry under entry's secondary icon */
-	nma_utils_setup_password_storage (widget, 0, (NMSetting *) wsec, sec->password_flags_name,
+	nma_utils_setup_password_storage (widget, NM_SETTING_SECRET_FLAG_AGENT_OWNED, (NMSetting *) wsec, sec->password_flags_name,
 	                                  FALSE, secrets_only);
 
 	if (wsec)
diff --git a/src/wireless-security/ws-wep-key.c b/src/wireless-security/ws-wep-key.c
index 0309042..e47c6dd 100644
--- a/src/wireless-security/ws-wep-key.c
+++ b/src/wireless-security/ws-wep-key.c
@@ -278,7 +278,7 @@ ws_wep_key_new (NMConnection *connection,
 	/* Create password-storage popup menu for password entry under entry's secondary icon */
 	if (connection)
 		setting = (NMSetting *) nm_connection_get_setting_wireless_security (connection);
-	nma_utils_setup_password_storage (widget, 0, setting, sec->password_flags_name,
+	nma_utils_setup_password_storage (widget, NM_SETTING_SECRET_FLAG_AGENT_OWNED, setting, sec->password_flags_name,
 	                                  FALSE, secrets_only);
 
 	if (connection) {
diff --git a/src/wireless-security/ws-wpa-psk.c b/src/wireless-security/ws-wpa-psk.c
index 1495707..edd21d7 100644
--- a/src/wireless-security/ws-wpa-psk.c
+++ b/src/wireless-security/ws-wpa-psk.c
@@ -201,7 +201,7 @@ ws_wpa_psk_new (NMConnection *connection, gboolean secrets_only)
 	/* Create password-storage popup menu for password entry under entry's secondary icon */
 	if (connection)
 		setting = (NMSetting *) nm_connection_get_setting_wireless_security (connection);
-	nma_utils_setup_password_storage (widget, 0, setting, sec->password_flags_name,
+	nma_utils_setup_password_storage (widget, NM_SETTING_SECRET_FLAG_AGENT_OWNED, setting, sec->password_flags_name,
 	                                  FALSE, secrets_only);
 
 	/* Fill secrets, if any */
