diff --git a/docs/nfc_auth.md b/docs/nfc_auth.md
index 4244e37..d42dc30 100644
--- a/docs/nfc_auth.md
+++ b/docs/nfc_auth.md
@@ -126,7 +126,11 @@ A disk-scoped **read** ticket also works and returns the same
 
 `diskDeviceKey` is `VirtualDisk.key` from `vm.config.hardware.device`
 (2000 for Hard disk 1). The replacement resolves it from the datastore
-path when `open` is given a VMDK rather than a key.
+path when `open` is given a VMDK rather than a key. That path may be
+the current leaf or a parent in `backing.parent` (snapshot deltas such
+as `…-000007.vmdk` after the VM has moved on to `…-000008.vmdk`). The
+ticket still uses the device key; `OPEN_FILE` then names the snapshot
+file.
 
 ### Return value: `vim.HostServiceTicket`
 
diff --git a/openvixdisklib/nfc_auth.py b/openvixdisklib/nfc_auth.py
index 96002ac..d5af760 100644
--- a/openvixdisklib/nfc_auth.py
+++ b/openvixdisklib/nfc_auth.py
@@ -128,13 +128,22 @@ def connect_vim(
 
 
 def _virtual_disk_key(vm: vim.VirtualMachine, disk_path: str) -> int:
-    """Return the VirtualDisk device key whose backing path is ``disk_path``."""
+    """Return the VirtualDisk device key for ``disk_path``.
+
+    ``disk_path`` may be the currently attached leaf or any parent in
+    that disk's snapshot delta chain (``backing.parent``). After a
+    snapshot, the VM's hardware points at the new leaf (for example
+    ``…-000008.vmdk``) while VDDK Open still uses the snapshot file
+    (``…-000007.vmdk``). Both share the same ``VirtualDisk.key``.
+    """
     for device in vm.config.hardware.device:
-        if isinstance(device, vim.vm.device.VirtualDisk):
-            backing = getattr(device, "backing", None)
-            file_name = getattr(backing, "fileName", None)
-            if file_name == disk_path:
+        if not isinstance(device, vim.vm.device.VirtualDisk):
+            continue
+        backing = getattr(device, "backing", None)
+        while backing is not None:
+            if getattr(backing, "fileName", None) == disk_path:
                 return device.key
+            backing = getattr(backing, "parent", None)
     raise ValueError(
         f"VMDK path {disk_path!r} is not attached to {vm._moId}")