diff --git a/src/App/Pages/Accounts/LockPageViewModel.cs b/src/App/Pages/Accounts/LockPageViewModel.cs
index c56968933..bb943dbd8 100644
--- a/src/App/Pages/Accounts/LockPageViewModel.cs
+++ b/src/App/Pages/Accounts/LockPageViewModel.cs
@@ -33,7 +33,7 @@ namespace Bit.App.Pages
         private readonly WeakEventManager<int?> _secretEntryFocusWeakEventManager = new WeakEventManager<int?>();
         private readonly IPolicyService _policyService;
         private readonly IPasswordGenerationService _passwordGenerationService;
-
+        private IDeviceTrustCryptoService _deviceTrustCryptoService;
         private string _email;
         private string _masterPassword;
         private string _pin;
@@ -65,6 +65,7 @@ namespace Bit.App.Pages
             _watchDeviceService = ServiceContainer.Resolve<IWatchDeviceService>();
             _policyService = ServiceContainer.Resolve<IPolicyService>();
             _passwordGenerationService = ServiceContainer.Resolve<IPasswordGenerationService>();
+            _deviceTrustCryptoService = ServiceContainer.Resolve<IDeviceTrustCryptoService>();
 
             PageTitle = AppResources.VerifyMasterPassword;
             TogglePasswordCommand = new Command(TogglePassword);
@@ -454,6 +455,11 @@ namespace Bit.App.Pages
             {
                 await _cryptoService.SetKeyAsync(key);
             }
+            if (await _deviceTrustCryptoService.GetUserTrustDeviceChoiceForDecryptionAsync())
+            {
+                await _deviceTrustCryptoService.TrustDeviceAsync();
+                await _deviceTrustCryptoService.SetUserTrustDeviceChoiceForDecryptionAsync(false);
+            }
             await DoContinueAsync();
         }
 
diff --git a/src/App/Pages/Accounts/LoginApproveDevicePage.xaml.cs b/src/App/Pages/Accounts/LoginApproveDevicePage.xaml.cs
index 9b80b18a5..35c15313f 100644
--- a/src/App/Pages/Accounts/LoginApproveDevicePage.xaml.cs
+++ b/src/App/Pages/Accounts/LoginApproveDevicePage.xaml.cs
@@ -15,7 +15,7 @@ namespace Bit.App.Pages
         private readonly LoginApproveDeviceViewModel _vm;
         private readonly AppOptions _appOptions;
 
-        public LoginApproveDevicePage(string email, AppOptions appOptions = null)
+        public LoginApproveDevicePage(AppOptions appOptions = null)
         {
             InitializeComponent();
             _vm = BindingContext as LoginApproveDeviceViewModel;
@@ -24,7 +24,6 @@ namespace Bit.App.Pages
             _vm.RequestAdminApprovalAction = () => RequestAdminApprovalAsync().FireAndForget();
             _vm.CloseAction = () => { Navigation.PopModalAsync(); };
             _vm.Page = this;
-            _vm.Email = email;
             _appOptions = appOptions;
         }
 
@@ -43,7 +42,7 @@ namespace Bit.App.Pages
 
         private async Task StartLogInWithMasterPassword()
         {
-            var page = new TwoFactorPage(false, _appOptions);
+            var page = new LockPage(_appOptions);
             await Navigation.PushModalAsync(new NavigationPage(page));
         }
 
diff --git a/src/App/Pages/Accounts/LoginApproveDeviceViewModel.cs b/src/App/Pages/Accounts/LoginApproveDeviceViewModel.cs
index 1838d1ce0..3f1b1db2c 100644
--- a/src/App/Pages/Accounts/LoginApproveDeviceViewModel.cs
+++ b/src/App/Pages/Accounts/LoginApproveDeviceViewModel.cs
@@ -107,6 +107,7 @@ namespace Bit.App.Pages
         {
             try
             {
+                Email = await _stateService.GetRememberedEmailAsync();
                 var decryptOptions = await _stateService.GetAccountDecryptionOptions();
                 RequestAdminApprovalEnabled = decryptOptions != null && decryptOptions.TrustedDeviceOption != null && decryptOptions.TrustedDeviceOption.HasAdminApproval;
                 ApproveWithMasterPasswordEnabled = decryptOptions != null && decryptOptions.HasMasterPassword;
diff --git a/src/App/Pages/Accounts/LoginPasswordlessRequestViewModel.cs b/src/App/Pages/Accounts/LoginPasswordlessRequestViewModel.cs
index 65726cee5..5750543d4 100644
--- a/src/App/Pages/Accounts/LoginPasswordlessRequestViewModel.cs
+++ b/src/App/Pages/Accounts/LoginPasswordlessRequestViewModel.cs
@@ -237,7 +237,11 @@ namespace Bit.App.Pages
                 else
                 {
                     _syncService.FullSyncAsync(true).FireAndForget();
-                    await _deviceTrustCryptoService.TrustDeviceAsync();
+                    if (await _deviceTrustCryptoService.GetUserTrustDeviceChoiceForDecryptionAsync())
+                    {
+                        await _deviceTrustCryptoService.TrustDeviceAsync();
+                        await _deviceTrustCryptoService.SetUserTrustDeviceChoiceForDecryptionAsync(false);
+                    }
                     LogInSuccessAction?.Invoke();
                 }
             }
diff --git a/src/App/Pages/Accounts/LoginSsoPage.xaml.cs b/src/App/Pages/Accounts/LoginSsoPage.xaml.cs
index a3acfe106..a910c9454 100644
--- a/src/App/Pages/Accounts/LoginSsoPage.xaml.cs
+++ b/src/App/Pages/Accounts/LoginSsoPage.xaml.cs
@@ -112,7 +112,7 @@ namespace Bit.App.Pages
             await AppHelpers.ClearPreviousPage();
 
             // Just for testing the screen
-            Application.Current.MainPage = new NavigationPage(new LoginApproveDevicePage(_vm.Email, _appOptions));
+            Application.Current.MainPage = new NavigationPage(new LoginApproveDevicePage(_appOptions));
             return;
 
             if (await _vaultTimeoutService.IsLockedAsync())
diff --git a/src/App/Pages/Accounts/LoginSsoPageViewModel.cs b/src/App/Pages/Accounts/LoginSsoPageViewModel.cs
index b24124ef4..fbf9bf4f2 100644
--- a/src/App/Pages/Accounts/LoginSsoPageViewModel.cs
+++ b/src/App/Pages/Accounts/LoginSsoPageViewModel.cs
@@ -31,7 +31,6 @@ namespace Bit.App.Pages
         private readonly IOrganizationService _organizationService;
 
         private string _orgIdentifier;
-        private string _email;
 
         public LoginSsoPageViewModel()
         {
@@ -58,12 +57,6 @@ namespace Bit.App.Pages
             set => SetProperty(ref _orgIdentifier, value);
         }
 
-        public string Email
-        {
-            get => _email;
-            set => SetProperty(ref _email, value);
-        }
-
         public ICommand LogInCommand { get; }
         public Action StartTwoFactorAction { get; set; }
         public Action StartSetPasswordAction { get; set; }
@@ -84,8 +77,6 @@ namespace Bit.App.Pages
                 {
                     OrgIdentifier = await _stateService.GetRememberedOrgIdentifierAsync();
                 }
-
-                Email = await _stateService.GetRememberedEmailAsync();
             }
             catch (Exception ex)
             {
diff --git a/src/Core/Services/DeviceTrustCryptoService.cs b/src/Core/Services/DeviceTrustCryptoService.cs
index a7550e657..e05fdf852 100644
--- a/src/Core/Services/DeviceTrustCryptoService.cs
+++ b/src/Core/Services/DeviceTrustCryptoService.cs
@@ -43,11 +43,6 @@ namespace Bit.Core.Services
 
         public async Task<DeviceResponse> TrustDeviceAsync()
         {
-            if (!await GetUserTrustDeviceChoiceForDecryptionAsync())
-            {
-                return null;
-            }
-
             // Attempt to get user key
             var userKey = await _cryptoService.GetEncKeyAsync();
             if (userKey == null)
diff --git a/src/Core/Services/StateService.cs b/src/Core/Services/StateService.cs
index 5bce3ca53..12e213b55 100644
--- a/src/Core/Services/StateService.cs
+++ b/src/Core/Services/StateService.cs
@@ -1300,12 +1300,12 @@ namespace Bit.Core.Services
 
         public async Task<bool> GetUserTrustDeviceChoiceForDecryptionAsync()
         {
-            return await _storageMediatorService.GetAsync<bool>(Constants.RememberDeviceTde, true);
+            return await _storageMediatorService.GetAsync<bool>(Constants.RememberDeviceTde);
         }
 
         public async Task SetUserTrustDeviceChoiceForDecryptionAsync(bool value)
         {
-            await _storageMediatorService.SaveAsync(Constants.RememberDeviceTde, true);
+            await _storageMediatorService.SaveAsync(Constants.RememberDeviceTde, value);
         }
 
         public ConfigResponse GetConfigs()