diff --git a/src/openpgp/openpgp.c b/src/openpgp/openpgp.c
index b57a674..df83939 100644
--- a/src/openpgp/openpgp.c
+++ b/src/openpgp/openpgp.c
@@ -923,6 +923,20 @@ static int pin_wrong_retry(const file_t *pin) {
     return PICOKEYS_ERR_BLOCKED;
 }
 
+static void clear_pin_access_status(const file_t *pin) {
+    if (pin->fid == EF_PW1) {
+        if (P2(apdu) == 0x81) {
+            has_pw1 = false;
+        }
+        else {
+            has_pw2 = false;
+        }
+    }
+    else if (pin->fid == EF_PW3) {
+        has_pw3 = false;
+    }
+}
+
 int check_pin(const file_t *pin, const uint8_t *data, size_t len) {
     if (!file_has_data(pin)) {
         return SW_REFERENCE_NOT_FOUND();
@@ -945,6 +959,7 @@ int check_pin(const file_t *pin, const uint8_t *data, size_t len) {
         return SW_CONDITIONS_NOT_SATISFIED();
     }
     if (mbedtls_ct_memcmp(file_get_data(pin) + off, dhash, sizeof(dhash)) != 0) {
+        clear_pin_access_status(pin);
         int retries;
         if ((retries = pin_wrong_retry(pin)) < PICOKEYS_OK) {
             return SW_PIN_BLOCKED();
diff --git a/src/openpgp/piv.c b/src/openpgp/piv.c
index 2596927..2ffeff6 100644
--- a/src/openpgp/piv.c
+++ b/src/openpgp/piv.c
@@ -674,6 +674,7 @@ static int authenticate_mgm(uint8_t algo, file_t *ef_mgm, uint8_t chal_len,
             clear_mgm_challenge();
             return SW_EXEC_ERROR();
         }
+        has_mgm = false;
         res_APDU_size += chal_len;
         return SW_OK();
     }
@@ -689,6 +690,7 @@ static int authenticate_mgm(uint8_t algo, file_t *ef_mgm, uint8_t chal_len,
         res_APDU[res_APDU_size++] = chal_len;
         memcpy(res_APDU + res_APDU_size, mgm_challenge, chal_len);
         res_APDU_size += chal_len;
+        has_mgm = false;
         return SW_OK();
     }