diff --git a/src/main/java/de/swiesend/secretservice/handlers/MessageHandler.java b/src/main/java/de/swiesend/secretservice/handlers/MessageHandler.java
index e7d02948..6d4869eb 100644
--- a/src/main/java/de/swiesend/secretservice/handlers/MessageHandler.java
+++ b/src/main/java/de/swiesend/secretservice/handlers/MessageHandler.java
@@ -41,14 +41,19 @@ public Object[] send(String service, String path, String iface, String method, S
             if (response instanceof org.freedesktop.dbus.messages.Error) {
 
                 String error = response.getName();
+                // Some Secret Service implementations (e.g. KeePassXC) return
+                // error replies with an empty body, so parameters may be
+                // zero-length; guard before reading parameters[0] to avoid
+                // ArrayIndexOutOfBoundsException.
+                String detail = (parameters != null && parameters.length > 0) ? String.valueOf(parameters[0]) : "";
                 switch (error) {
                     case "org.freedesktop.Secret.Error.NoSession":
                     case "org.freedesktop.Secret.Error.NoSuchObject":
-                        log.warn(error + ": " + parameters[0]);
+                        log.warn(error + ": " + detail);
                         return null;
                     case "org.gnome.keyring.Error.Denied":
                     case "org.freedesktop.Secret.Error.IsLocked":
-                        log.info(error + ": " + parameters[0]);
+                        log.info(error + ": " + detail);
                         return null;
                     case "org.freedesktop.DBus.Error.NoReply":
                     case "org.freedesktop.DBus.Error.UnknownMethod":
diff --git a/src/main/java/de/swiesend/secretservice/simple/SimpleCollection.java b/src/main/java/de/swiesend/secretservice/simple/SimpleCollection.java
index 81384257..8ef6f560 100644
--- a/src/main/java/de/swiesend/secretservice/simple/SimpleCollection.java
+++ b/src/main/java/de/swiesend/secretservice/simple/SimpleCollection.java
@@ -614,6 +614,14 @@ public char[] getSecret(String objectPath) {
 
         final Item item = getItem(objectPath);
 
+        // Some Secret Service implementations (e.g. KeePassXC) lock items
+        // independently of the collection: the collection can report unlocked
+        // while the item is still locked, so the unlock() above is a no-op and
+        // the read below returns IsLocked. Unlock the item explicitly first.
+        if (item != null && item.isLocked()) {
+            performPrompt(service.unlock(Arrays.asList(item.getPath())).b);
+        }
+
         char[] decrypted = null;
         try (final Secret secret = item.getSecret(session.getPath())) {
             decrypted = transport.decrypt(secret);