diff --git a/README.md b/README.md
index 3b5b28f..9f17b6d 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@
 Our SDK is available on Maven Central.
 
 ```groovy
-implementation 'de.contentpass:contentpass-android:2.2.6'
+implementation 'de.contentpass:contentpass-android:2.2.7'
 ```
 
 Add this to your app's `build.gradle` file's `dependencies` element.
diff --git a/lib/build.gradle.kts b/lib/build.gradle.kts
index a38474f..2523bba 100644
--- a/lib/build.gradle.kts
+++ b/lib/build.gradle.kts
@@ -58,7 +58,7 @@ kapt {
 extra.apply{
     set("PUBLISH_GROUP_ID", "de.contentpass")
     set("PUBLISH_ARTIFACT_ID", "contentpass-android")
-    set("PUBLISH_VERSION", "2.2.6")
+    set("PUBLISH_VERSION", "2.2.7")
 }
 
 apply("${rootProject.projectDir}/scripts/publish-module.gradle")
diff --git a/lib/src/main/java/de/contentpass/lib/KeyStore.kt b/lib/src/main/java/de/contentpass/lib/KeyStore.kt
index ed9a659..6006415 100644
--- a/lib/src/main/java/de/contentpass/lib/KeyStore.kt
+++ b/lib/src/main/java/de/contentpass/lib/KeyStore.kt
@@ -50,7 +50,16 @@ internal class KeyStore(private val context: Context, private val propertyId: St
         if (!keystore.containsAlias(keyPairAlias)) {
             createKeyPair()
         }
-        val pair = keystore.getEntry(keyPairAlias, null) as VendorKeyStore.PrivateKeyEntry
+        val pair = try {
+            keystore.getEntry(keyPairAlias, null) as? VendorKeyStore.PrivateKeyEntry
+        } catch (e: Exception) {
+            null
+        } ?: run {
+            // Android 8 can throw when the entry is invalidated/corrupted; recreate it.
+            keystore.deleteEntry(keyPairAlias)
+            createKeyPair()
+            keystore.getEntry(keyPairAlias, null) as VendorKeyStore.PrivateKeyEntry
+        }
         privateKey = pair.privateKey
         publicKey = pair.certificate.publicKey
     }