diff --git a/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c b/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c
index c4377230ca..3074887269 100644
--- a/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c
+++ b/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c
@@ -56,7 +56,7 @@ int acquire_luks2_key(
                 return -ENOANO;
 
         /* If we're using a PIN, and the luks header has a salt, it better have a pin too */
-        if ((flags & TPM2_FLAGS_USE_PIN) && salt && !pin)
+        if ((flags & TPM2_FLAGS_USE_PIN) && salt_size > 0 && !pin)
                 return -ENOANO;
 
         if (pin && salt_size > 0) {