diff --git a/CMakeLists.txt b/CMakeLists.txt
index aca07f048..853605d10 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -327,7 +327,7 @@ set(PACKAGE "libwebsockets")
 set(CPACK_PACKAGE_NAME "${PACKAGE}")
 set(CPACK_PACKAGE_VERSION_MAJOR "4")
 set(CPACK_PACKAGE_VERSION_MINOR "0")
-set(CPACK_PACKAGE_VERSION_PATCH "5")
+set(CPACK_PACKAGE_VERSION_PATCH "6")
 set(CPACK_PACKAGE_RELEASE 1)
 set(CPACK_GENERATOR "RPM")
 set(CPACK_PACKAGE_VERSION "${CPACK_PACKAGE_VERSION_MAJOR}.${CPACK_PACKAGE_VERSION_MINOR}.${CPACK_PACKAGE_VERSION_PATCH}")
diff --git a/lib/core/context.c b/lib/core/context.c
index 8ea35dc6d..66201e9c4 100644
--- a/lib/core/context.c
+++ b/lib/core/context.c
@@ -128,12 +128,17 @@ lws_state_notify_protocol_init(struct lws_state_manager *mgr,
 #if defined(LWS_WITH_SECURE_STREAMS_SYS_AUTH_API_AMAZON_COM)
 	/*
 	 * Skip this if we are running something without the policy for it
+	 *
+	 * If root token is empty, skip too.
 	 */
 	if (target == LWS_SYSTATE_AUTH1 &&
 	    context->pss_policies &&
 	    !lws_system_blob_get_size(lws_system_get_blob(context,
 						          LWS_SYSBLOB_TYPE_AUTH,
-						          0))) {
+						          0)) &&
+	    lws_system_blob_get_size(lws_system_get_blob(context,
+						          LWS_SYSBLOB_TYPE_AUTH,
+						          1))) {
 		lwsl_info("%s: AUTH1 state triggering api.amazon.com auth\n", __func__);
 		/*
 		 * Start trying to acquire it if it's not already in progress