diff --git a/os_brick/encryptors/luks.py b/os_brick/encryptors/luks.py
index 3e0f1bb56..d2bb9c8f4 100644
--- a/os_brick/encryptors/luks.py
+++ b/os_brick/encryptors/luks.py
@@ -181,7 +181,12 @@ class LuksEncryptor(cryptsetup.CryptsetupEncryptor):
     def _close_volume(self, **kwargs):
         """Closes the device (effectively removes the dm-crypt mapping)."""
         LOG.debug("closing encrypted volume %s", self.dev_path)
+        # NOTE(mdbooth): luksClose will return 4 (wrong device specified) if
+        # the device doesn't exist. We assume here that the caller hasn't
+        # specified the wrong device, and that it doesn't exist because it
+        # isn't open. We don't fail in this case in order to make this
+        # operation idempotent.
         self._execute('cryptsetup', 'luksClose', self.dev_name,
-                      run_as_root=True, check_exit_code=True,
+                      run_as_root=True, check_exit_code=[0, 4],
                       root_helper=self._root_helper,
                       attempts=3)
diff --git a/os_brick/tests/encryptors/test_luks.py b/os_brick/tests/encryptors/test_luks.py
index 546698b0b..45c57a0f2 100644
--- a/os_brick/tests/encryptors/test_luks.py
+++ b/os_brick/tests/encryptors/test_luks.py
@@ -169,7 +169,7 @@ class LuksEncryptorTestCase(test_cryptsetup.CryptsetupEncryptorTestCase):
         mock_execute.assert_has_calls([
             mock.call('cryptsetup', 'luksClose', self.dev_name,
                       root_helper=self.root_helper,
-                      attempts=3, run_as_root=True, check_exit_code=True),
+                      attempts=3, run_as_root=True, check_exit_code=[0, 4]),
         ])
 
     @mock.patch('os_brick.executor.Executor._execute')
@@ -179,7 +179,7 @@ class LuksEncryptorTestCase(test_cryptsetup.CryptsetupEncryptorTestCase):
         mock_execute.assert_has_calls([
             mock.call('cryptsetup', 'luksClose', self.dev_name,
                       root_helper=self.root_helper,
-                      attempts=3, run_as_root=True, check_exit_code=True),
+                      attempts=3, run_as_root=True, check_exit_code=[0, 4]),
         ])
 
     def test_get_mangled_passphrase(self):
@@ -224,7 +224,7 @@ class LuksEncryptorTestCase(test_cryptsetup.CryptsetupEncryptorTestCase):
                       check_exit_code=True),
             mock.call('cryptsetup', 'luksClose', self.dev_name,
                       root_helper=self.root_helper, run_as_root=True,
-                      check_exit_code=True, attempts=3),
+                      check_exit_code=[0, 4], attempts=3),
             mock.call('cryptsetup', 'luksAddKey', self.dev_path,
                       process_input=''.join([fake_key_mangled,
                                              '\n', fake_key,
@@ -237,7 +237,7 @@ class LuksEncryptorTestCase(test_cryptsetup.CryptsetupEncryptorTestCase):
                       check_exit_code=True),
             mock.call('cryptsetup', 'luksClose', self.dev_name,
                       root_helper=self.root_helper, run_as_root=True,
-                      check_exit_code=True, attempts=3),
+                      check_exit_code=[0, 4], attempts=3),
             mock.call('cryptsetup', 'luksRemoveKey', self.dev_path,
                       process_input=fake_key_mangled,
                       root_helper=self.root_helper, run_as_root=True,