diff --git a/music_assistant/server/controllers/config.py b/music_assistant/server/controllers/config.py
index 5a24442cd..700002a26 100644
--- a/music_assistant/server/controllers/config.py
+++ b/music_assistant/server/controllers/config.py
@@ -35,6 +35,7 @@
     CONF_SERVER_ID,
     CONFIGURABLE_CORE_CONTROLLERS,
     ENCRYPT_SUFFIX,
+    SECURE_STRING_SUBSTITUTE,
 )
 from music_assistant.server.helpers.api import api_command
 from music_assistant.server.helpers.util import load_provider_module
@@ -239,6 +240,16 @@ async def get_provider_config_entries(
             raise KeyError(msg)
         if values is None:
             values = self.get(f"{CONF_PROVIDERS}/{instance_id}/values", {}) if instance_id else {}
+
+        # handle (edge) case where encrypted values are passed along
+        for key, value in values.items():
+            if not isinstance(value, str):
+                continue
+            if value == SECURE_STRING_SUBSTITUTE:
+                values[key] = value = self.get(f"{CONF_PROVIDERS}/{instance_id}/values/{key}", None)  # noqa: PLW2901
+            if value.startswith(ENCRYPT_SUFFIX):
+                values[key] = self.decrypt_string(value)
+
         return (
             await prov_mod.get_config_entries(
                 self.mass, instance_id=instance_id, action=action, values=values
@@ -304,7 +315,7 @@ async def set_provider_config_value(
     ) -> None:
         """Set single ProviderConfig value."""
         config = await self.get_provider_config(instance_id)
-        config.update({**config.to_raw(), key: value})
+        config.update({key: value})
         config.validate()
         conf_key = f"{CONF_PROVIDERS}/{instance_id}/values/{key}"
         self.set(conf_key, config.get_value(key))