diff --git a/repos/gems/src/server/wm/decorator_nitpicker.h b/repos/gems/src/server/wm/decorator_nitpicker.h
index 94a59ca0d..aeb0e645a 100644
--- a/repos/gems/src/server/wm/decorator_nitpicker.h
+++ b/repos/gems/src/server/wm/decorator_nitpicker.h
@@ -447,7 +447,10 @@ struct Wm::Decorator_nitpicker_session : Genode::Rpc_object<Nitpicker::Session>,
 
 	void buffer(Framebuffer::Mode mode, bool use_alpha) override
 	{
-		_nitpicker_session.buffer(mode, use_alpha);
+		/*
+		 * See comment in 'Wm::Nitpicker::Session_component::buffer'.
+		 */
+		Nitpicker::Session_client(_nitpicker_session.cap()).buffer(mode, use_alpha);
 	}
 
 	void focus(Genode::Capability<Nitpicker::Session>) { }
diff --git a/repos/gems/src/server/wm/nitpicker.h b/repos/gems/src/server/wm/nitpicker.h
index b890907fa..c1acf2ad7 100644
--- a/repos/gems/src/server/wm/nitpicker.h
+++ b/repos/gems/src/server/wm/nitpicker.h
@@ -942,7 +942,17 @@ class Wm::Nitpicker::Session_component : public Rpc_object<Nitpicker::Session>,
 
 		void buffer(Framebuffer::Mode mode, bool has_alpha) override
 		{
-			_session.buffer(mode, has_alpha);
+			/*
+			 * We must not perform the 'buffer' operation on the connection
+			 * object because the 'Nitpicker::Connection::buffer'
+			 * implementation implicitly performs upgrade operations.
+			 *
+			 * Here, we merely want to forward the buffer RPC call to the
+			 * wrapped nitpicker session. Otherwise, we would perform
+			 * session upgrades initiated by the wm client's buffer
+			 * operation twice.
+			 */
+			Nitpicker::Session_client(_session.cap()).buffer(mode, has_alpha);
 			_has_alpha = has_alpha;
 		}