diff --git a/src/com/android/settings/ChooseLockGeneric.java b/src/com/android/settings/ChooseLockGeneric.java
index 2592e83..4dde340 100644
--- a/src/com/android/settings/ChooseLockGeneric.java
+++ b/src/com/android/settings/ChooseLockGeneric.java
@@ -292,7 +292,7 @@
                 }
             } else if (requestCode == CHOOSE_LOCK_REQUEST
                     || requestCode == ENABLE_ENCRYPTION_REQUEST) {
-                if (resultCode != RESULT_CANCELED) {
+                if (resultCode != RESULT_CANCELED || mForChangeCredRequiredForBoot) {
                     getActivity().setResult(resultCode, data);
                     finish();
                 }
diff --git a/src/com/android/settings/SaveChosenLockWorkerBase.java b/src/com/android/settings/SaveChosenLockWorkerBase.java
index 128bd99..39620d5 100644
--- a/src/com/android/settings/SaveChosenLockWorkerBase.java
+++ b/src/com/android/settings/SaveChosenLockWorkerBase.java
@@ -17,6 +17,7 @@
 package com.android.settings;
 
 import android.app.Fragment;
+import android.content.Context;
 import android.content.Intent;
 import android.os.AsyncTask;
 import android.os.Bundle;
@@ -70,7 +71,10 @@
         mUtils.setSeparateProfileChallengeEnabled(mUserId, true);
         mWasSecureBefore = mUtils.isSecure(mUserId);
 
-        if (UserManager.get(getContext()).getUserInfo(mUserId).isPrimary()) {
+        Context context = getContext();
+        // If context is null, we're being invoked to change the setCredentialRequiredToDecrypt,
+        // and we made sure that this is the primary user already.
+        if (context == null || UserManager.get(context).getUserInfo(mUserId).isPrimary()) {
             mUtils.setCredentialRequiredToDecrypt(credentialRequired);
         }
 
diff --git a/src/com/android/settings/SecuritySettings.java b/src/com/android/settings/SecuritySettings.java
index 8464462..8966974 100644
--- a/src/com/android/settings/SecuritySettings.java
+++ b/src/com/android/settings/SecuritySettings.java
@@ -1054,6 +1054,7 @@
         static boolean canChangeRequireCredentialBeforeStartup(Context context) {
             DevicePolicyManager dpm = context.getSystemService(DevicePolicyManager.class);
             return UserManager.get(context).isAdminUser()
+                    && UserManager.get(context).isPrimaryUser()
                     && LockPatternUtils.isDeviceEncryptionEnabled()
                     && !dpm.getDoNotAskCredentialsOnBoot();
         }