diff --git a/core/src/apps/common/request_pin.py b/core/src/apps/common/request_pin.py
index b24c1dc91c..2d093bfe5c 100644
--- a/core/src/apps/common/request_pin.py
+++ b/core/src/apps/common/request_pin.py
@@ -17,6 +17,11 @@ if __debug__:
     from apps.debug import input_signal
 
 
+def can_lock_device() -> bool:
+    """Return True if the device has a PIN set or SD-protect enabled."""
+    return config.has_pin() or storage.sd_salt.is_enabled()
+
+
 async def request_pin(
     ctx: wire.GenericContext,
     prompt: str = "Enter your PIN",
diff --git a/core/src/boot.py b/core/src/boot.py
index 54a9d6f640..7dc00b8502 100644
--- a/core/src/boot.py
+++ b/core/src/boot.py
@@ -4,14 +4,14 @@ import storage.sd_salt
 from trezor import config, log, loop, res, ui, utils, wire
 from trezor.pin import show_pin_timeout
 
-from apps.common.request_pin import verify_user_pin
+from apps.common.request_pin import can_lock_device, verify_user_pin
 
 
 async def bootscreen() -> None:
     ui.display.orientation(storage.device.get_rotation())
     while True:
         try:
-            if storage.sd_salt.is_enabled() or config.has_pin():
+            if can_lock_device():
                 await lockscreen()
             await verify_user_pin()
             storage.init_unlocked()