diff --git a/modules/dcache-qos/src/main/java/org/dcache/qos/services/engine/provider/ALRPStorageUnitQoSProvider.java b/modules/dcache-qos/src/main/java/org/dcache/qos/services/engine/provider/ALRPStorageUnitQoSProvider.java
index d3c91d20c47..2831e6a355e 100644
--- a/modules/dcache-qos/src/main/java/org/dcache/qos/services/engine/provider/ALRPStorageUnitQoSProvider.java
+++ b/modules/dcache-qos/src/main/java/org/dcache/qos/services/engine/provider/ALRPStorageUnitQoSProvider.java
@@ -159,8 +159,8 @@ public FileQoSRequirements fetchRequirements(FileQoSUpdate update) throws QoSExc
         }
 
         FileAttributes attributes = descriptor.getAttributes();
-        AccessLatency accessLatency = attributes.getAccessLatency();
-        RetentionPolicy retentionPolicy = attributes.getRetentionPolicy();
+        AccessLatency accessLatency = attributes.getAccessLatencyIfPresent().orElse(null);
+        RetentionPolicy retentionPolicy = attributes.getRetentionPolicyIfPresent().orElse(null);
 
         String unitKey = attributes.getStorageClass() + "@" + attributes.getHsm();
         StorageUnit storageUnit = poolSelectionUnit().getStorageUnit(unitKey);
diff --git a/modules/dcache-qos/src/main/java/org/dcache/qos/services/verifier/data/db/JdbcVerifyOperationDao.java b/modules/dcache-qos/src/main/java/org/dcache/qos/services/verifier/data/db/JdbcVerifyOperationDao.java
index c39754d3f36..91c0a152bbb 100644
--- a/modules/dcache-qos/src/main/java/org/dcache/qos/services/verifier/data/db/JdbcVerifyOperationDao.java
+++ b/modules/dcache-qos/src/main/java/org/dcache/qos/services/verifier/data/db/JdbcVerifyOperationDao.java
@@ -118,6 +118,9 @@ private static VerifyOperation toOperation(ResultSet rs, int row) throws SQLExce
     }
 
     private static String serialize(Subject subject) throws QoSException {
+        if (subject == null) {
+            return null;
+        }
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
         try (ObjectOutputStream ostream = new ObjectOutputStream(baos)) {
             ostream.writeObject(subject);
@@ -128,6 +131,9 @@ private static String serialize(Subject subject) throws QoSException {
     }
 
     private static Object deserialize(String base64) throws SQLException {
+        if (base64 == null) {
+            return null;
+        }
         byte[] array = Base64.getDecoder().decode(base64);
         ByteArrayInputStream bais = new ByteArrayInputStream(array);
         try (ObjectInputStream istream = new ObjectInputStream(bais)) {
diff --git a/modules/dcache-qos/src/main/java/org/dcache/qos/util/QoSPermissionUtils.java b/modules/dcache-qos/src/main/java/org/dcache/qos/util/QoSPermissionUtils.java
index a941a9e8071..daa4f19c1ad 100644
--- a/modules/dcache-qos/src/main/java/org/dcache/qos/util/QoSPermissionUtils.java
+++ b/modules/dcache-qos/src/main/java/org/dcache/qos/util/QoSPermissionUtils.java
@@ -74,6 +74,18 @@ public class QoSPermissionUtils {
      * @param attributes
      */
     public static boolean canModifyQos(Subject subject, FileAttributes attributes) {
+        if (subject == null) {
+            /*
+             *  This is a workaround for legacy database entries before
+             *  https://github.com/dCache/dcache-security-fixes/tree/fix/master/qos-propagate-subject-to-adjuster
+             *  was introduced.  An incompatibility was overlooked whereby
+             *  the database could contain entries when updated by liquibase,
+             *  thus making the new subject field null.
+             *
+             *  In this case we just return false.
+             */
+            return false;
+        }
         return Subjects.isRoot(subject) || Subjects.getUid(subject) == attributes.getOwner();
     }