diff --git a/pkg/registry/apis/secret/inline/inline_secure_value.go b/pkg/registry/apis/secret/inline/inline_secure_value.go
index 3dfb191ca62..590d311c9c1 100644
--- a/pkg/registry/apis/secret/inline/inline_secure_value.go
+++ b/pkg/registry/apis/secret/inline/inline_secure_value.go
@@ -209,6 +209,7 @@ func (s *LocalInlineSecureValueService) CreateInline(ctx context.Context, owner
 			Value:       &secret,
 			Decrypters: []string{
 				serviceIdentity,
+				owner.APIGroup,
 			},
 		},
 	}
diff --git a/pkg/registry/apis/secret/inline/inline_secure_value_test.go b/pkg/registry/apis/secret/inline/inline_secure_value_test.go
index 9c058622810..707d4f16711 100644
--- a/pkg/registry/apis/secret/inline/inline_secure_value_test.go
+++ b/pkg/registry/apis/secret/inline/inline_secure_value_test.go
@@ -242,7 +242,8 @@ func TestIntegration_InlineSecureValue_CreateInline(t *testing.T) {
 
 		tu := testutils.Setup(t)
 
-		secret := common.NewSecretValue("test-value")
+		rawSecret := "test-value"
+		secret := common.NewSecretValue(rawSecret)
 
 		serviceIdentity := "service-identity"
 
@@ -259,7 +260,15 @@ func TestIntegration_InlineSecureValue_CreateInline(t *testing.T) {
 
 		decryptedResult, ok := decryptedValues[createdName]
 		require.True(t, ok)
-		require.Equal(t, decryptedResult.Value().DangerouslyExposeAndConsumeValue(), secret.DangerouslyExposeAndConsumeValue())
+		require.Equal(t, decryptedResult.Value().DangerouslyExposeAndConsumeValue(), rawSecret)
+
+		// can also decrypt with the owner.APIGroup as a decrypter
+		decryptedValues, err = tu.DecryptService.Decrypt(t.Context(), owner.APIGroup, owner.Namespace, []string{createdName})
+		require.NoError(t, err)
+
+		decryptedResult, ok = decryptedValues[createdName]
+		require.True(t, ok)
+		require.Equal(t, decryptedResult.Value().DangerouslyExposeAndConsumeValue(), rawSecret)
 	})
 
 	t.Run("when the auth info is missing it returns an error", func(t *testing.T) {