diff --git a/src/ble/gatt_client.c b/src/ble/gatt_client.c
index 1b218fe5d..b6f2d9ee3 100644
--- a/src/ble/gatt_client.c
+++ b/src/ble/gatt_client.c
@@ -883,7 +883,9 @@ static int gatt_client_run_for_gatt_client(gatt_client_t * gatt_client){
     // wait until re-encryption complete
     if (gatt_client->reencryption_active) return 0;
 
-    if ((gatt_client->reencryption_result != ERROR_CODE_SUCCESS) && (gatt_client->gatt_client_state != P_READY)){
+    bool client_request_pending = gatt_client->gatt_client_state != P_READY;
+
+    if (client_request_pending && (gatt_client->reencryption_result != ERROR_CODE_SUCCESS)){
 #ifndef ENABLE_LE_PROACTIVE_AUTHENTICATION
         // re-encryption failed and we have a pending client request
         // reactive authentication: try to resolve it by deleting bonding information if we started pairing before
@@ -910,7 +912,7 @@ static int gatt_client_run_for_gatt_client(gatt_client_t * gatt_client){
     if (gatt_client->wait_for_pairing_complete) return 0;
 
     // verify security level
-    if (gatt_client_required_security_level > gatt_client->security_level){
+    if (client_request_pending && (gatt_client_required_security_level > gatt_client->security_level)){
         log_info("Trigger pairing, current security level %u, required %u\n", gatt_client->security_level, gatt_client_required_security_level);
         gatt_client->wait_for_pairing_complete = 1;
         // set att error code for pairing failure based on required level