diff --git a/src/libxrpl/tx/transactors/token/ConfidentialMPTMirrorUpdate.cpp b/src/libxrpl/tx/transactors/token/ConfidentialMPTMirrorUpdate.cpp
index f4c7233a7d..62d0800bd7 100644
--- a/src/libxrpl/tx/transactors/token/ConfidentialMPTMirrorUpdate.cpp
+++ b/src/libxrpl/tx/transactors/token/ConfidentialMPTMirrorUpdate.cpp
@@ -148,28 +148,20 @@ ConfidentialMPTMirrorUpdate::preclaim(PreclaimContext const& ctx)
     if (hasAuditorAmount && !sleIssuance->isFieldPresent(sfAuditorEncryptionKey))
         return tecNO_PERMISSION;
 
-    // Epoch staleness. Mirror epochs count how many times the
-    // holder's mirrors have been re-encrypted; the issuance key epochs count
-    // how many times the keys have rotated.
-    std::uint32_t const issuerKeyEpoch = (*sleIssuance)[~sfIssuerKeyEpoch].value_or(0);
-    std::uint32_t const auditorKeyEpoch = (*sleIssuance)[~sfAuditorKeyEpoch].value_or(0);
-    std::uint32_t const issuerMirrorEpoch = (*sleMptoken)[~sfIssuerKeyMirrorEpoch].value_or(0);
-    std::uint32_t const auditorMirrorEpoch = (*sleMptoken)[~sfAuditorKeyMirrorEpoch].value_or(0);
-
-    // The issuer mirror can only be re-encrypted while it is stale.
-    if (hasIssuerAmount && issuerMirrorEpoch >= issuerKeyEpoch)
+    // A issuer mirror may only be re-encrypted while it is stale, reject if it is already current.
+    if (hasIssuerAmount && isIssuerMirrorCurrent(*sleIssuance, *sleMptoken))
         return tecNO_PERMISSION;
 
     if (hasAuditorAmount)
     {
         // An issuer-mode auditor-only migration: the issuer mirror must already be up to date.
-        if (hasHolder && !hasIssuerAmount && issuerMirrorEpoch != issuerKeyEpoch)
+        if (hasHolder && !hasIssuerAmount && !isIssuerMirrorCurrent(*sleIssuance, *sleMptoken))
             return tecNO_PERMISSION;
 
-        // The auditor mirror can only be re-encrypted while it is stale, unless
-        // this is its first-time registration (no auditor mirror yet).
-        bool const hasAuditorMirror = sleMptoken->isFieldPresent(sfAuditorEncryptedBalance);
-        if (hasAuditorMirror && auditorMirrorEpoch >= auditorKeyEpoch)
+        // A auditor mirror may only be re-encrypted while it is stale, reject if it is already
+        // current. isAuditorMirrorCurrent reports an absent auditor mirror as stale, which is what
+        // allows an auditor-only migration to create one for the first time.
+        if (isAuditorMirrorCurrent(*sleIssuance, *sleMptoken))
             return tecNO_PERMISSION;
     }