diff --git a/package.json b/package.json
index e16e7d7..a7a4c4b 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
 	"name": "integrations-worker-app",
 	"version": "0.1.0",
 	"private": true,
-	"packageManager": "bun@1.2.21",
+	"packageManager": "bun@1.4.4",
 	"scripts": {
 		"dev": "next dev --turbopack",
 		"build": "next build --webpack",
diff --git a/tests/security-crypto.test.ts b/tests/security-crypto.test.ts
index bfc25ba..b2b6817 100644
--- a/tests/security-crypto.test.ts
+++ b/tests/security-crypto.test.ts
@@ -122,6 +122,21 @@ describe('token encryption', () => {
     assert.equal(isLegacyCiphertext(legacy), true)
     assert.equal(await decryptToken(legacy), 'legacy-linear-token')
   })
+
+  test('rejects empty legacy plaintext and a missing legacy key', async () => {
+    const empty = CryptoJS.AES.encrypt('', TEST_ENCRYPTION_SECRET).toString()
+    await assert.rejects(() => decryptToken(empty), /Failed to decrypt token/)
+
+    const legacy = CryptoJS.AES.encrypt('legacy-linear-token', TEST_ENCRYPTION_SECRET).toString()
+    const key = process.env.ENCRYPTION_KEY
+    try {
+      delete process.env.ENCRYPTION_KEY
+      await assert.rejects(() => decryptToken(legacy), /Failed to decrypt token/)
+    } finally {
+      if (key === undefined) delete process.env.ENCRYPTION_KEY
+      else process.env.ENCRYPTION_KEY = key
+    }
+  })
 })
 
 describe('webhook signatures', () => {