diff --git a/third_party/mfrc522_integration/mfrc522_rp2040_integration.c b/third_party/mfrc522_integration/mfrc522_rp2040_integration.c
index f9cbeea..fa3bd06 100644
--- a/third_party/mfrc522_integration/mfrc522_rp2040_integration.c
+++ b/third_party/mfrc522_integration/mfrc522_rp2040_integration.c
@@ -227,10 +227,22 @@ uint8_t mfrc522_interface_spi_deinit(void)
  */
 uint8_t mfrc522_interface_spi_read(uint8_t reg, uint8_t *buf, uint16_t len)
 {
+    if (len == UINT16_MAX)
+        return 1;
+
+    // We need to read len + 1 bytes...
+    const size_t local_buf_len = len + 1;
+    uint8_t local_buf[local_buf_len];
+    memset(local_buf, 0, local_buf_len);
+
     cs_select();
-    uint16_t n_bytes_read = spi_read_blocking(MFRC522_CFG_SPI_INSTANCE, reg, buf, len);
+    uint16_t n_bytes_read = spi_read_blocking(MFRC522_CFG_SPI_INSTANCE, reg, local_buf, local_buf_len);
     cs_deselect();
-    return (uint8_t) (n_bytes_read == len) ? 0 : 1;
+
+    // ...and ignore the first byte we received.
+    memcpy(buf, local_buf + 1, len);
+
+    return (uint8_t) (n_bytes_read == local_buf_len) ? 0 : 1;
 }
 
 /**
@@ -245,10 +257,20 @@ uint8_t mfrc522_interface_spi_read(uint8_t reg, uint8_t *buf, uint16_t len)
  */
 uint8_t mfrc522_interface_spi_write(uint8_t reg, uint8_t *buf, uint16_t len)
 {
+    if (len == UINT16_MAX)
+        return 1;
+
+    // We need to send the address byte (reg) as part of the payload.
+    const size_t local_buf_len = len + 1;
+    uint8_t local_buf[local_buf_len];
+    local_buf[0] = reg;
+    memcpy(&local_buf[1], buf, len);
+
     cs_select();
-    uint16_t n_bytes_written = spi_write_blocking(MFRC522_CFG_SPI_INSTANCE, buf, len);
+    uint16_t n_bytes_written = spi_write_blocking(MFRC522_CFG_SPI_INSTANCE, local_buf, local_buf_len);
     cs_deselect();
-    return (uint8_t) (n_bytes_written == len) ? 0 : 1;
+
+    return (uint8_t) (n_bytes_written == local_buf_len) ? 0 : 1;
 }
 
 /**