diff --git a/pkg/services/secrets/migrator/provisioning.go b/pkg/services/secrets/migrator/provisioning.go
index d075029bf3d..5c05d0d5c22 100644
--- a/pkg/services/secrets/migrator/provisioning.go
+++ b/pkg/services/secrets/migrator/provisioning.go
@@ -49,7 +49,8 @@ func (p provisioningSecrets) reEncrypt(
 			Find(&rows)
 	}); err != nil {
 		logger.Warn("Could not find any provisioning secrets to re-encrypt", "error", err, "action", action)
-		return false
+		// resource table may not exists (when not using unified storage and right db), so we don't report error here.
+		return true
 	}
 
 	var failures int
diff --git a/pkg/storage/unified/sql/db/dbimpl/dbimpl.go b/pkg/storage/unified/sql/db/dbimpl/dbimpl.go
index 2ee703ab1c1..98bba8aed1a 100644
--- a/pkg/storage/unified/sql/db/dbimpl/dbimpl.go
+++ b/pkg/storage/unified/sql/db/dbimpl/dbimpl.go
@@ -104,6 +104,10 @@ func newResourceDBProvider(grafanaDB infraDB.DB, cfg *setting.Cfg, tracer trace.
 		return p, fmt.Errorf("invalid db type specified: %s", dbType)
 
 	// If we have an empty Resource API db config, try with the core Grafana database config
+	case grafanaDBType != "":
+		p.registerMetrics = true
+		p.engine, err = getEngine(cfg)
+		return p, err
 	case grafanaDB != nil:
 		// try to use the grafana db connection (should only happen in tests)
 		if fallbackGetter.Bool(grafanaDBInstrumentQueriesKey) {
@@ -111,10 +115,6 @@ func newResourceDBProvider(grafanaDB infraDB.DB, cfg *setting.Cfg, tracer trace.
 		}
 		p.engine = grafanaDB.GetEngine()
 		return p, nil
-	case grafanaDBType != "":
-		p.registerMetrics = true
-		p.engine, err = getEngine(cfg)
-		return p, err
 	default:
 		return p, fmt.Errorf("no database type specified")
 	}