diff --git a/client/server/server.go b/client/server/server.go
index d92399693..c89d1f22d 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -2840,21 +2840,23 @@ func (s *Server) SessionHolder() (ipcauth.Principal, bool) {
 // This triggers stamping of legacy profiles, and reloads the current config
 // if the handle is the active profile.
 func (s *Server) OwnsProfile(id ipcauth.Identity, handle string) bool {
-	act, err := s.profileManager.GetActiveProfileState()
-	if err != nil {
-		log.Warnf("failed to get active profile: %v", err)
-	}
-	if act != nil {
-		handle = act.ID.String()
+	var activeProfile *profilemanager.ActiveProfileState
+	if handle == "" {
+		activeState, err := s.profileManager.GetActiveProfileState()
+		if err != nil {
+			log.Warnf("failed to get active profile: %v", err)
+		}
+		activeProfile = activeState
+		handle = activeProfile.ID.String()
 	}
 	resolved, err := s.resolveProfileHandle(handle, id)
 	if err != nil {
 		log.Errorf("failed to resolve profile %q: %v", handle, err)
 		return false
 	}
-	// resolveProfileHandle might stamp legacy profile owners and if
-	if act != nil {
-		config, _, err := s.getConfig(act)
+	// resolveProfileHandle might stamp legacy profile owners
+	if activeProfile != nil {
+		config, _, err := s.getConfig(activeProfile)
 		if err != nil {
 			log.Errorf("failed to get active profile config: %v", err)
 		}