diff --git a/AUDIT.md b/AUDIT.md
index 678862f..eddd2bf 100644
--- a/AUDIT.md
+++ b/AUDIT.md
@@ -33,6 +33,7 @@ after each item.
 - [x] `ai/openai_compatible_runtime.ex`
 - [x] `ai/one_shot.ex`
 - [x] `ai/secret_key.ex`
+- [x] `ai/secret_backend.ex`
 
 ---
 
diff --git a/lib/bds/ai/secret_backend.ex b/lib/bds/ai/secret_backend.ex
index 32cf838..f00b1fe 100644
--- a/lib/bds/ai/secret_backend.ex
+++ b/lib/bds/ai/secret_backend.ex
@@ -41,10 +41,7 @@ defmodule BDS.AI.SecretBackend do
   @spec decrypt(String.t()) :: {:ok, String.t()} | {:error, term()}
   def decrypt(encoded) when is_binary(encoded) do
     with {:ok, key} <- secret_key() do
-      case decrypt_with(encoded, key) do
-        {:ok, plaintext} -> {:ok, plaintext}
-        {:error, :invalid_ciphertext} -> decrypt_legacy(encoded)
-      end
+      decrypt_with_fallback(encoded, key)
     end
   end
 
@@ -79,6 +76,13 @@ defmodule BDS.AI.SecretBackend do
     ]
   end
 
+  defp decrypt_with_fallback(encoded, key) do
+    case decrypt_with(encoded, key) do
+      {:ok, _plaintext} = ok -> ok
+      {:error, :invalid_ciphertext} -> decrypt_legacy(encoded)
+    end
+  end
+
   defp decrypt_with(encoded, key) do
     with {:ok, binary} <- Base.decode64(encoded),
          <<iv::binary-size(12), tag::binary-size(16), ciphertext::binary>> <- binary,