diff --git a/src/main/java/com/threerings/presents/server/ClientManager.java b/src/main/java/com/threerings/presents/server/ClientManager.java
index 9a04fcda9..a8669151f 100644
--- a/src/main/java/com/threerings/presents/server/ClientManager.java
+++ b/src/main/java/com/threerings/presents/server/ClientManager.java
@@ -390,12 +390,6 @@ public class ClientManager
         // immediately
         clobj.release();
 
-        // Grab the shared secret from the session and stick it into the client local
-        PresentsSession session = getClient(username);
-        if (session != null) {
-            clobj.getLocal(ClientLocal.class).secret = session.getSecret();
-        }
-
         // stuff the object into the mapping table
         _objmap.put(username, clobj);
 
diff --git a/src/main/java/com/threerings/presents/server/PresentsSession.java b/src/main/java/com/threerings/presents/server/PresentsSession.java
index 34edbbaea..0b70a74c2 100644
--- a/src/main/java/com/threerings/presents/server/PresentsSession.java
+++ b/src/main/java/com/threerings/presents/server/PresentsSession.java
@@ -402,6 +402,9 @@ public class PresentsSession
             return;
         }
 
+        // Dump our secret into the client local for easy access
+        clobj.getLocal(ClientLocal.class).secret = getSecret();
+
         // finish up our regular business
         sessionWillStart();
         sendBootstrap();
@@ -545,6 +548,9 @@ public class PresentsSession
             return;
         }
 
+        // Update our client secret with the new auth request
+        _clobj.getLocal(ClientLocal.class).secret = getSecret();
+
         // let derived classes do any session resuming
         sessionWillResume();