diff --git a/authmate/authmate.go b/authmate/authmate.go
index 0faed2c..6f9c91e 100644
--- a/authmate/authmate.go
+++ b/authmate/authmate.go
@@ -404,7 +404,9 @@ func buildBearerTokens(key *keys.PrivateKey, impersonate bool, table *eacl.Table
 func buildSessionToken(key *keys.PrivateKey, lifetime lifetimeOptions, ctx sessionTokenContext, gateKey *keys.PublicKey) (*session.Container, error) {
 	tok := new(session.Container)
 	tok.ForVerb(ctx.verb)
-	tok.AppliedTo(ctx.containerID)
+	if !ctx.containerID.Equals(cid.ID{}) {
+		tok.ApplyOnlyTo(ctx.containerID)
+	}
 
 	tok.SetID(uuid.New())
 	tok.SetAuthKey((*frostfsecdsa.PublicKey)(gateKey))