diff --git a/core/src/main/java/google/registry/ui/server/registrar/RegistryLockGetAction.java b/core/src/main/java/google/registry/ui/server/registrar/RegistryLockGetAction.java
index 656e7b591..4f8daff0c 100644
--- a/core/src/main/java/google/registry/ui/server/registrar/RegistryLockGetAction.java
+++ b/core/src/main/java/google/registry/ui/server/registrar/RegistryLockGetAction.java
@@ -159,12 +159,12 @@ public final class RegistryLockGetAction implements JsonGetAction {
             () ->
                 RegistryLockDao.getLocksByRegistrarId(clientId).stream()
                     .filter(lock -> !lock.isLockRequestExpired(jpaTm().getTransactionTime()))
-                    .filter(lock -> !lock.isUnlockRequestExpired(jpaTm().getTransactionTime()))
                     .map(lock -> lockToMap(lock, isAdmin))
                     .collect(toImmutableList()));
   }
 
   private ImmutableMap<String, ?> lockToMap(RegistryLock lock, boolean isAdmin) {
+    DateTime now = jpaTm().getTransactionTime();
     return new ImmutableMap.Builder<String, Object>()
         .put(FULLY_QUALIFIED_DOMAIN_NAME_PARAM, lock.getDomainName())
         .put(
@@ -174,7 +174,8 @@ public final class RegistryLockGetAction implements JsonGetAction {
         .put(
             IS_UNLOCK_PENDING_PARAM,
             lock.getUnlockRequestTimestamp().isPresent()
-                && !lock.getUnlockCompletionTimestamp().isPresent())
+                && !lock.getUnlockCompletionTimestamp().isPresent()
+                && !lock.isUnlockRequestExpired(now))
         .put(USER_CAN_UNLOCK_PARAM, isAdmin || !lock.isSuperuser())
         .build();
   }
diff --git a/core/src/test/java/google/registry/tools/DomainLockUtilsTest.java b/core/src/test/java/google/registry/tools/DomainLockUtilsTest.java
index e4d2daaae..6ed5eb02c 100644
--- a/core/src/test/java/google/registry/tools/DomainLockUtilsTest.java
+++ b/core/src/test/java/google/registry/tools/DomainLockUtilsTest.java
@@ -108,7 +108,21 @@ public final class DomainLockUtilsTest {
   public void testSuccess_createLock_previousLockExpired() {
     domainLockUtils.saveNewRegistryLockRequest(DOMAIN_NAME, "TheRegistrar", POC_ID, false);
     clock.advanceBy(Duration.standardDays(1));
-    domainLockUtils.saveNewRegistryLockRequest(DOMAIN_NAME, "TheRegistrar", POC_ID, false);
+    RegistryLock lock =
+        domainLockUtils.saveNewRegistryLockRequest(DOMAIN_NAME, "TheRegistrar", POC_ID, false);
+    domainLockUtils.verifyAndApplyLock(lock.getVerificationCode(), false);
+    verifyProperlyLockedDomain(false);
+  }
+
+  @Test
+  public void testSuccess_createUnlock_previousUnlockRequestExpired() {
+    domainLockUtils.administrativelyApplyLock(DOMAIN_NAME, "TheRegistrar", POC_ID, false);
+    domainLockUtils.saveNewRegistryUnlockRequest(DOMAIN_NAME, "TheRegistrar", false);
+    clock.advanceBy(Duration.standardDays(1));
+    RegistryLock unlockRequest =
+        domainLockUtils.saveNewRegistryUnlockRequest(DOMAIN_NAME, "TheRegistrar", false);
+    domainLockUtils.verifyAndApplyUnlock(unlockRequest.getVerificationCode(), false);
+    assertThat(reloadDomain().getStatusValues()).containsNoneIn(REGISTRY_LOCK_STATUSES);
   }
 
   @Test
diff --git a/core/src/test/java/google/registry/ui/server/registrar/RegistryLockGetActionTest.java b/core/src/test/java/google/registry/ui/server/registrar/RegistryLockGetActionTest.java
index 3c522c386..b41a09bf6 100644
--- a/core/src/test/java/google/registry/ui/server/registrar/RegistryLockGetActionTest.java
+++ b/core/src/test/java/google/registry/ui/server/registrar/RegistryLockGetActionTest.java
@@ -189,6 +189,14 @@ public final class RegistryLockGetActionTest {
                         "TheRegistrar",
                         "locks",
                         ImmutableList.of(
+                            new ImmutableMap.Builder<>()
+                                .put("fullyQualifiedDomainName", "expiredunlock.test")
+                                .put("lockedTime", "2000-06-08T22:00:00.000Z")
+                                .put("lockedBy", "johndoe@theregistrar.com")
+                                .put("userCanUnlock", true)
+                                .put("isLockPending", false)
+                                .put("isUnlockPending", false)
+                                .build(),
                             new ImmutableMap.Builder<>()
                                 .put("fullyQualifiedDomainName", "example.test")
                                 .put("lockedTime", "2000-06-09T22:00:00.000Z")
diff --git a/core/src/test/java/google/registry/webdriver/RegistrarConsoleScreenshotTest.java b/core/src/test/java/google/registry/webdriver/RegistrarConsoleScreenshotTest.java
index 25a5bcba4..2025c9509 100644
--- a/core/src/test/java/google/registry/webdriver/RegistrarConsoleScreenshotTest.java
+++ b/core/src/test/java/google/registry/webdriver/RegistrarConsoleScreenshotTest.java
@@ -450,6 +450,13 @@ public class RegistrarConsoleScreenshotTest extends WebDriverTestCase {
     server.runInAppEngineEnvironment(
         () -> {
           createTld("tld");
+          // expired unlock request
+          DomainBase expiredUnlockRequestDomain = persistActiveDomain("expiredunlock.tld");
+          saveRegistryLock(createRegistryLock(expiredUnlockRequestDomain)
+              .asBuilder()
+              .setLockCompletionTimestamp(START_OF_TIME.minusDays(1))
+              .setUnlockRequestTimestamp(START_OF_TIME.minusDays(1))
+              .build());
           DomainBase domain = persistActiveDomain("example.tld");
           saveRegistryLock(createRegistryLock(domain).asBuilder().isSuperuser(true).build());
           DomainBase otherDomain = persistActiveDomain("otherexample.tld");
diff --git a/core/src/test/resources/google/registry/webdriver/goldens/chrome-linux/RegistrarConsoleScreenshotTest_registryLock_nonEmpty_admin_page.png b/core/src/test/resources/google/registry/webdriver/goldens/chrome-linux/RegistrarConsoleScreenshotTest_registryLock_nonEmpty_admin_page.png
index 246484687..6d70e570e 100644
Binary files a/core/src/test/resources/google/registry/webdriver/goldens/chrome-linux/RegistrarConsoleScreenshotTest_registryLock_nonEmpty_admin_page.png and b/core/src/test/resources/google/registry/webdriver/goldens/chrome-linux/RegistrarConsoleScreenshotTest_registryLock_nonEmpty_admin_page.png differ