diff --git a/src/Session/HordeSession.php b/src/Session/HordeSession.php
index adb40529..d9d660b9 100644
--- a/src/Session/HordeSession.php
+++ b/src/Session/HordeSession.php
@@ -306,28 +306,28 @@ public function clearScopeWithPrefixes(string $app, array $prefixes): void
 
     public function getAuthenticatedUser(): ?string
     {
-        $value = $this->data['horde']['auth/userId'] ?? null;
+        $value = $this->getScoped('horde', 'auth/userId');
 
         return is_string($value) ? $value : null;
     }
 
     public function getAuthId(): ?string
     {
-        $value = $this->data['horde']['auth/authId'] ?? null;
+        $value = $this->getScoped('horde', 'auth/authId');
 
         return is_string($value) ? $value : null;
     }
 
     public function getBrowserFingerprint(): ?string
     {
-        $value = $this->data['horde']['auth/browser'] ?? null;
+        $value = $this->getScoped('horde', 'auth/browser');
 
         return is_string($value) ? $value : null;
     }
 
     public function getRemoteAddress(): ?string
     {
-        $value = $this->data['horde']['auth/remoteAddr'] ?? null;
+        $value = $this->getScoped('horde', 'auth/remoteAddr');
 
         return is_string($value) ? $value : null;
     }
diff --git a/test/Unit/Session/HordeSessionTest.php b/test/Unit/Session/HordeSessionTest.php
index 0561bfd3..acf92cac 100644
--- a/test/Unit/Session/HordeSessionTest.php
+++ b/test/Unit/Session/HordeSessionTest.php
@@ -18,6 +18,7 @@
 use Horde\SessionHandler\Session;
 use Horde\SessionHandler\SessionId;
 use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\TestCase;
 use Horde_Pack;
@@ -221,6 +222,47 @@ public function testGetRemoteAddress(): void
         self::assertSame('192.168.1.1', $session->getRemoteAddress());
     }
 
+    /**
+     * Strings written through setScoped() carry the NOT_SERIALIZED marker
+     * on the wire. The meta getters must return them without it, both on
+     * the writing session and after a round trip through toPayload().
+     * The tests above seed $data with unprefixed strings, so they did not
+     * catch the marker leaking out.
+     *
+     * @return array<string, array{string, string, string}>
+     */
+    public static function metaGetterProvider(): array
+    {
+        return [
+            'authenticated user' => ['auth/userId', 'getAuthenticatedUser', 'alice'],
+            'auth id' => ['auth/authId', 'getAuthId', 'alice@example.com'],
+            'browser fingerprint' => ['auth/browser', 'getBrowserFingerprint', 'Mozilla/5.0'],
+            'remote address' => ['auth/remoteAddr', 'getRemoteAddress', '192.168.1.1'],
+        ];
+    }
+
+    #[Test]
+    #[DataProvider('metaGetterProvider')]
+    public function testMetaGetterStripsStorageMarker(string $key, string $getter, string $value): void
+    {
+        $session = $this->createSession();
+        $session->setScoped('horde', $key, $value);
+
+        self::assertSame($value, $session->{$getter}());
+    }
+
+    #[Test]
+    #[DataProvider('metaGetterProvider')]
+    public function testMetaGetterStripsStorageMarkerAfterPayloadRoundTrip(string $key, string $getter, string $value): void
+    {
+        $writer = $this->createSession();
+        $writer->setScoped('horde', $key, $value);
+
+        $reader = $this->createSession($writer->toPayload());
+
+        self::assertSame($value, $reader->{$getter}());
+    }
+
     #[Test]
     public function testGetAuthTimestamp(): void
     {