diff --git a/pkg/services/secrets/manager/manager.go b/pkg/services/secrets/manager/manager.go
index aa5c539ecf8..631097d7c8f 100644
--- a/pkg/services/secrets/manager/manager.go
+++ b/pkg/services/secrets/manager/manager.go
@@ -291,8 +291,15 @@ func newRandomDataKey() ([]byte, error) {
 }
 
 func (s *SecretsService) Decrypt(ctx context.Context, payload []byte) ([]byte, error) {
+	if len(payload) == 0 {
+		return nil, fmt.Errorf("unable to decrypt empty payload")
+	}
+
 	// Use legacy encryption service if featuremgmt.FlagDisableEnvelopeEncryption toggle is on
 	if s.features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption) {
+		if len(payload) > 0 && payload[0] == '#' {
+			return nil, fmt.Errorf("failed to decrypt a secret encrypted with envelope encryption: envelope encryption is disabled")
+		}
 		return s.enc.Decrypt(ctx, payload, setting.SecretKey)
 	}
 
@@ -309,11 +316,6 @@ func (s *SecretsService) Decrypt(ctx context.Context, payload []byte) ([]byte, e
 		}
 	}()
 
-	if len(payload) == 0 {
-		err = fmt.Errorf("unable to decrypt empty payload")
-		return nil, err
-	}
-
 	var dataKey []byte
 
 	if payload[0] != '#' {