diff --git a/src/auth/authcon.c b/src/auth/authcon.c
index 9148624322..54e842dbbf 100644
--- a/src/auth/authcon.c
+++ b/src/auth/authcon.c
@@ -331,7 +331,8 @@ afsconf_PickClientSecObj(struct afsconf_dir *dir, afsconf_secflags flags,
 	     * explicitly requested. Check for this, and bail out if we
 	     * get one. Note that this leaks a security object at present
 	     */
-	    if (*scIndex == RX_SECIDX_NULL) {
+	    if (!(flags & AFSCONF_SECOPTS_FALLBACK_NULL) &&
+		*scIndex == RX_SECIDX_NULL) {
 		sc = NULL;
 		code = AFSCONF_NOTFOUND;
 		goto out;