diff --git a/services/core/java/com/android/server/trust/TrustManagerService.java b/services/core/java/com/android/server/trust/TrustManagerService.java
index c8b5b3e54bb40..48e46db7ceb6a 100644
--- a/services/core/java/com/android/server/trust/TrustManagerService.java
+++ b/services/core/java/com/android/server/trust/TrustManagerService.java
@@ -159,6 +159,11 @@ public class TrustManagerService extends SystemService {
 
     void refreshAgentList(int userId) {
         if (DEBUG) Slog.d(TAG, "refreshAgentList()");
+        if (userId != UserHandle.USER_ALL && userId < UserHandle.USER_OWNER) {
+            Log.e(TAG, "refreshAgentList(userId=" + userId + "): Invalid user handle,"
+                    + " must be USER_ALL or a specific user.", new Throwable("here"));
+            userId = UserHandle.USER_ALL;
+        }
         PackageManager pm = mContext.getPackageManager();
 
         List<UserInfo> userInfos;
@@ -228,11 +233,13 @@ public class TrustManagerService extends SystemService {
         boolean trustMayHaveChanged = false;
         for (int i = 0; i < obsoleteAgents.size(); i++) {
             AgentInfo info = obsoleteAgents.valueAt(i);
-            if (info.agent.isManagingTrust()) {
-                trustMayHaveChanged = true;
+            if (userId == UserHandle.USER_ALL || userId == info.userId) {
+                if (info.agent.isManagingTrust()) {
+                    trustMayHaveChanged = true;
+                }
+                info.agent.unbind();
+                mActiveAgents.remove(info);
             }
-            info.agent.unbind();
-            mActiveAgents.remove(info);
         }
 
         if (trustMayHaveChanged) {