diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index c9a74e59b..fd31efa24 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -656,14 +656,17 @@ public class KsmClient {
         // There is no way to differentiate if an error is caused by
         // a non-existing record or a pure parse failure.
         catch (Error | Exception e) {
-            logger.warn("Keeper notation \"{}\" could not be resolved "
-                    + "to a record: {}", notation, e.getMessage());
             logger.debug("Retrieval of record by Keeper notation failed.", e);
 
             // If the secret is not found, invoke the fallback function
             if (fallbackFunction != null)
                 return fallbackFunction.get();
 
+            // Show the warning only if there is no fallback function
+            // and this was the last attempt
+            logger.warn("Keeper notation \"{}\" could not be resolved "
+                    + "to a record: {}", notation, e.getMessage());
+
             return CompletableFuture.completedFuture(null);
         }
         finally {
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index 717a125e3..632d597fa 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -152,21 +152,21 @@ public class KsmSecretService implements VaultSecretService {
         // Attempt to find a KSM config for this connection or group
         String ksmConfig = getConnectionGroupKsmConfig(userContext, connectable);
 
+        // Get the user-supplied KSM config, if allowed by config and
+        // set by the user
+        String userKsmConfig = getUserKSMConfig(userContext, connectable);
+
+        // If the user config is not defined or happens to be the same
+        // as admin-defined one, resolve without the fallback
+        if (userKsmConfig == null || Objects.equal(userKsmConfig, ksmConfig)) {
+            return getClient(ksmConfig).getSecret(name);
+        }
+
         return getClient(ksmConfig).getSecret(name, new GuacamoleExceptionSupplier<Future<String>>() {
 
             @Override
             public Future<String> get() throws GuacamoleException {
-
-                // Get the user-supplied KSM config, if allowed by config and
-                // set by the user
-                String userKsmConfig = getUserKSMConfig(userContext, connectable);
-
-                // If the user config happens to be the same as admin-defined one,
-                // don't bother trying again
-                if (userKsmConfig != null && !Objects.equal(userKsmConfig, ksmConfig))
-                    return getClient(userKsmConfig).getSecret(name);
-
-                return CompletableFuture.completedFuture(null);
+                return getClient(userKsmConfig).getSecret(name);
             }
 
         });