diff --git a/src/com/android/settings/biometrics/face/FaceSettings.java b/src/com/android/settings/biometrics/face/FaceSettings.java
index 05e37781c70..9766f34cdad 100644
--- a/src/com/android/settings/biometrics/face/FaceSettings.java
+++ b/src/com/android/settings/biometrics/face/FaceSettings.java
@@ -69,6 +69,8 @@ public class FaceSettings extends DashboardFragment {
     private Preference mRemoveButton;
     private Preference mEnrollButton;
 
+    private boolean mConfirmingPassword;
+
     private final FaceSettingsRemoveButtonPreferenceController.Listener mRemovalListener = () -> {
 
         // Disable the toggles until the user re-enrolls
@@ -150,9 +152,15 @@ public class FaceSettings extends DashboardFragment {
     @Override
     public void onResume() {
         super.onResume();
-        if (mToken == null) {
+
+        if (mToken == null && !mConfirmingPassword) {
+            // Generate challenge in onResume instead of onCreate, since FaceSettings can be
+            // created while Keyguard is showing, in which case the resetLockout revokeChallenge
+            // will invalidate the too-early created challenge here.
             final long challenge = mFaceManager.generateChallenge();
             ChooseLockSettingsHelper helper = new ChooseLockSettingsHelper(getActivity(), this);
+
+            mConfirmingPassword = true;
             if (!helper.launchConfirmationActivity(CONFIRM_REQUEST,
                     getString(R.string.security_settings_face_preference_title),
                     null, null, challenge, mUserId)) {
@@ -173,6 +181,7 @@ public class FaceSettings extends DashboardFragment {
     public void onActivityResult(int requestCode, int resultCode, Intent data) {
         super.onActivityResult(requestCode, resultCode, data);
         if (requestCode == CONFIRM_REQUEST) {
+            mConfirmingPassword = false;
             if (resultCode == RESULT_FINISHED || resultCode == RESULT_OK) {
                 mFaceManager.setActiveUser(mUserId);
                 // The pin/pattern/password was set.
@@ -196,10 +205,18 @@ public class FaceSettings extends DashboardFragment {
     @Override
     public void onStop() {
         super.onStop();
-        mToken = null;
-        final int result = mFaceManager.revokeChallenge();
-        if (result < 0) {
-            Log.w(TAG, "revokeChallenge failed, result: " + result);
+
+        if (!mEnrollController.isClicked() && !getActivity().isChangingConfigurations()
+                && !mConfirmingPassword) {
+            // Revoke challenge and finish
+            if (mToken != null) {
+                final int result = mFaceManager.revokeChallenge();
+                if (result < 0) {
+                    Log.w(TAG, "revokeChallenge failed, result: " + result);
+                }
+                mToken = null;
+            }
+            getActivity().finish();
         }
     }
 
diff --git a/src/com/android/settings/biometrics/face/FaceSettingsEnrollButtonPreferenceController.java b/src/com/android/settings/biometrics/face/FaceSettingsEnrollButtonPreferenceController.java
index ec7b1948fea..a087ccc78e4 100644
--- a/src/com/android/settings/biometrics/face/FaceSettingsEnrollButtonPreferenceController.java
+++ b/src/com/android/settings/biometrics/face/FaceSettingsEnrollButtonPreferenceController.java
@@ -42,6 +42,7 @@ public class FaceSettingsEnrollButtonPreferenceController extends BasePreference
     private byte[] mToken;
     private SettingsActivity mActivity;
     private Button mButton;
+    private boolean mIsClicked;
 
     public FaceSettingsEnrollButtonPreferenceController(Context context) {
         this(context, KEY);
@@ -63,6 +64,7 @@ public class FaceSettingsEnrollButtonPreferenceController extends BasePreference
 
     @Override
     public void onClick(View v) {
+        mIsClicked = true;
         final Intent intent = new Intent();
         intent.setClassName("com.android.settings", FaceEnrollIntroduction.class.getName());
         intent.putExtra(Intent.EXTRA_USER_ID, mUserId);
@@ -83,6 +85,13 @@ public class FaceSettingsEnrollButtonPreferenceController extends BasePreference
         mToken = token;
     }
 
+    // Return the click state, then clear its state.
+    public boolean isClicked() {
+        final boolean wasClicked = mIsClicked;
+        mIsClicked = false;
+        return wasClicked;
+    }
+
     public void setActivity(SettingsActivity activity) {
         mActivity = activity;
     }