diff --git a/app/server/modules/volumes/__tests__/volumes.service.test.ts b/app/server/modules/volumes/__tests__/volumes.service.test.ts
index f401ba26..998c56e3 100644
--- a/app/server/modules/volumes/__tests__/volumes.service.test.ts
+++ b/app/server/modules/volumes/__tests__/volumes.service.test.ts
@@ -16,6 +16,7 @@ import { withContext } from "~/server/core/request-context";
 import { asShortId } from "~/server/utils/branded";
 import { createTestVolume } from "~/test/helpers/volume";
 import { config } from "~/server/core/config";
+import { cryptoUtils } from "~/server/utils/crypto";
 
 afterEach(() => {
 	config.flags.enableLocalAgent = false;
@@ -286,4 +287,31 @@ describe("volumeService.testConnection", () => {
 			expect.objectContaining({ name: "volume.testConnection" }),
 		);
 	});
+
+	test("decrypts encrypted config values before testing the connection", async () => {
+		config.flags.enableLocalAgent = true;
+		agentManagerMock.runVolumeCommand.mockResolvedValue({
+			name: "volume.testConnection",
+			result: { success: true, message: "Connection successful" },
+		});
+		const encryptedPassword = await cryptoUtils.sealSecret("plain-password");
+
+		await volumeService.testConnection({
+			backend: "smb",
+			server: "127.0.0.1",
+			share: "backup",
+			username: "backup-user",
+			password: encryptedPassword,
+			domain: "",
+			vers: "3.0",
+			port: 445,
+			mapToContainerUidGid: false,
+			readOnly: false,
+		});
+
+		expect(agentManagerMock.runVolumeCommand).toHaveBeenCalledWith("local", {
+			name: "volume.testConnection",
+			backendConfig: expect.objectContaining({ password: "plain-password" }),
+		});
+	});
 });
diff --git a/app/server/modules/volumes/volume.service.ts b/app/server/modules/volumes/volume.service.ts
index bdb843ed..01d08506 100644
--- a/app/server/modules/volumes/volume.service.ts
+++ b/app/server/modules/volumes/volume.service.ts
@@ -285,11 +285,13 @@ const updateVolume = async (shortId: ShortId, volumeData: UpdateVolumeBody) => {
 };
 
 const testConnection = async (backendConfig: BackendConfig) => {
+	const resolvedConfig = await decryptVolumeConfig(backendConfig);
+
 	if (!config.flags.enableLocalAgent) {
-		return Effect.runPromise(testVolumeConnection(backendConfig));
+		return Effect.runPromise(testVolumeConnection(resolvedConfig));
 	}
 
-	const command = await runVolumeCommand(LOCAL_AGENT_ID, { name: "volume.testConnection", backendConfig });
+	const command = await runVolumeCommand(LOCAL_AGENT_ID, { name: "volume.testConnection", backendConfig: resolvedConfig });
 	return command.result;
 };