diff --git a/pkg/services/datasources/service/datasource_service.go b/pkg/services/datasources/service/datasource_service.go
index c95c6294fdf..b17ccb618fe 100644
--- a/pkg/services/datasources/service/datasource_service.go
+++ b/pkg/services/datasources/service/datasource_service.go
@@ -146,6 +146,12 @@ func (s *Service) GetDataSourcesByType(ctx context.Context, query *models.GetDat
 
 func (s *Service) AddDataSource(ctx context.Context, cmd *models.AddDataSourceCommand) error {
 	var err error
+	// this is here for backwards compatibility
+	cmd.EncryptedSecureJsonData, err = s.SecretsService.EncryptJsonData(ctx, cmd.SecureJsonData, secrets.WithoutScope())
+	if err != nil {
+		return err
+	}
+
 	if err := s.SQLStore.AddDataSource(ctx, cmd); err != nil {
 		return err
 	}
@@ -287,11 +293,10 @@ func (s *Service) DecryptedValues(ctx context.Context, ds *models.DataSource) (m
 	}
 
 	if exist {
-		err := json.Unmarshal([]byte(secret), &decryptedValues)
-		if err != nil {
-			return nil, err
-		}
-	} else if len(ds.SecureJsonData) > 0 {
+		err = json.Unmarshal([]byte(secret), &decryptedValues)
+	}
+
+	if (!exist || err != nil) && len(ds.SecureJsonData) > 0 {
 		decryptedValues, err = s.MigrateSecrets(ctx, ds)
 		if err != nil {
 			return nil, err
@@ -302,9 +307,13 @@ func (s *Service) DecryptedValues(ctx context.Context, ds *models.DataSource) (m
 }
 
 func (s *Service) MigrateSecrets(ctx context.Context, ds *models.DataSource) (map[string]string, error) {
-	secureJsonData, err := s.SecretsService.DecryptJsonData(ctx, ds.SecureJsonData)
-	if err != nil {
-		return nil, err
+	secureJsonData := make(map[string]string)
+	for k, v := range ds.SecureJsonData {
+		decrypted, err := s.SecretsService.Decrypt(ctx, v)
+		if err != nil {
+			return nil, err
+		}
+		secureJsonData[k] = string(decrypted)
 	}
 
 	jsonData, err := json.Marshal(secureJsonData)
@@ -579,5 +588,11 @@ func (s *Service) fillWithSecureJSONData(ctx context.Context, cmd *models.Update
 		}
 	}
 
+	// this is here for backwards compatibility
+	cmd.EncryptedSecureJsonData, err = s.SecretsService.EncryptJsonData(ctx, cmd.SecureJsonData, secrets.WithoutScope())
+	if err != nil {
+		return err
+	}
+
 	return nil
 }