diff --git a/scd/app-p15.c b/scd/app-p15.c
index fc17e66ff..ed1ba7a69 100644
--- a/scd/app-p15.c
+++ b/scd/app-p15.c
@@ -3382,6 +3382,15 @@ do_sign (app_t app, ctrl_t ctrl, const char *keyidstr, int hashalgo,
       return gpg_error (GPG_ERR_INV_CARD);
     }
 
+  /* We need some more info about the key - get the keygrip to
+   * populate these fields.  */
+  err = keygrip_from_prkdf (app, prkdf);
+  if (err)
+    {
+      log_error ("p15: keygrip_from_prkdf failed: %s\n", gpg_strerror (err));
+      return err;
+    }
+
 
   /* Prepare PIN verification.  This is split so that we can do
    * MSE operation for some task after having selected the key file but
@@ -3492,15 +3501,6 @@ do_sign (app_t app, ctrl_t ctrl, const char *keyidstr, int hashalgo,
     }
 
 
-  /* We need some more info about the key - get the keygrip to
-   * populate these fields.  */
-  err = keygrip_from_prkdf (app, prkdf);
-  if (err)
-    {
-      log_error ("p15: keygrip_from_prkdf failed: %s\n", gpg_strerror (err));
-      return err;
-    }
-
   /* Manage security environment needs to be tweaked for certain cards. */
   if (mse_done)
     err = 0;
@@ -3651,6 +3651,15 @@ do_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
       return gpg_error (GPG_ERR_INV_CARD);
     }
 
+  /* We need some more info about the key - get the keygrip to
+   * populate these fields.  */
+  err = keygrip_from_prkdf (app, prkdf);
+  if (err)
+    {
+      log_error ("p15: keygrip_from_prkdf failed: %s\n", gpg_strerror (err));
+      return err;
+    }
+
 
   /* Verify the PIN.  */
   err = prepare_verify_pin (app, keyidstr, prkdf, aodf);