diff --git a/dstack/kms/auth-eth/contracts/DstackKms.sol b/dstack/kms/auth-eth/contracts/DstackKms.sol
index d4c5b37c2..55161d29a 100644
--- a/dstack/kms/auth-eth/contracts/DstackKms.sol
+++ b/dstack/kms/auth-eth/contracts/DstackKms.sol
@@ -489,20 +489,19 @@ contract DstackKms is Initializable, Ownable2StepUpgradeable, UUPSUpgradeable, E
     {
         result.gatewayAppId = gatewayAppId;
         result.currentAppEpoch = isKms ? 0 : currentAppEpoch(request.appInfo.appId);
+        if (_rootEpochs.length > 0) {
+            result.currentRootEpoch = _currentRootEpoch;
+            result.currentRootEpochHash = _rootEpochs[_currentRootEpoch].chainHash;
+        }
         if (!(isKms
                     ? AuthorizationOperation.isKms(request.operation)
                     : AuthorizationOperation.isApp(request.operation))) {
             result.rejectionReason = "Invalid authorization operation";
             return result;
         }
-        if (_rootEpochs.length == 0) {
-            if (request.operation != AuthorizationOperation.KMS_BOOTSTRAP) {
-                result.rejectionReason = "Root epoch not registered";
-                return result;
-            }
-        } else {
-            result.currentRootEpoch = _currentRootEpoch;
-            result.currentRootEpochHash = _rootEpochs[_currentRootEpoch].chainHash;
+        if (_rootEpochs.length == 0 && request.operation != AuthorizationOperation.KMS_BOOTSTRAP) {
+            result.rejectionReason = "Root epoch not registered";
+            return result;
         }
         uint256 latestAllowedRoot = isKms ? _latestRootEpoch() : _currentRootEpoch;
         if (request.requestedRootEpoch.isSet && request.requestedRootEpoch.value > latestAllowedRoot) {
diff --git a/dstack/kms/auth-eth/test/DstackKms.t.sol b/dstack/kms/auth-eth/test/DstackKms.t.sol
index c5defef38..a12c3782d 100644
--- a/dstack/kms/auth-eth/test/DstackKms.t.sol
+++ b/dstack/kms/auth-eth/test/DstackKms.t.sol
@@ -659,13 +659,23 @@ contract DstackKmsTest is Test {
         kms.activateRootEpoch(1, chainHash(chainHash(bytes32(0), ca(0xa0), k256(0xb0)), ca(0xa1), k256(0xb1)));
         vm.stopPrank();
 
+        bytes32 hash1 = chainHash(chainHash(bytes32(0), ca(0xa0), k256(0xb0)), ca(0xa1), k256(0xb1));
         DstackKms.AuthorizationResult memory result = authorize(authorizationInfo(user), false);
         assertFalse(result.isAllowed);
         assertEq(result.rejectionReason, "App not registered");
         assertEq(result.currentRootEpoch, 1);
-        assertEq(
-            result.currentRootEpochHash, chainHash(chainHash(bytes32(0), ca(0xa0), k256(0xb0)), ca(0xa1), k256(0xb1))
+        assertEq(result.currentRootEpochHash, hash1);
+
+        DstackKms.AuthorizationRequest memory request = DstackKms.AuthorizationRequest(
+            authorizationInfo(user),
+            keccak256("kms_serve"),
+            DstackKms.OptionalUint256(false, 0),
+            DstackKms.OptionalUint256(false, 0)
         );
+        result = kms.authorizeApp(request);
+        assertEq(result.rejectionReason, "Invalid authorization operation");
+        assertEq(result.currentRootEpoch, 1);
+        assertEq(result.currentRootEpochHash, hash1);
     }
 
     function test_IsKmsAllowed() public {