diff --git a/steward/ansible/executor.py b/steward/ansible/executor.py
index e061930..ac8667e 100644
--- a/steward/ansible/executor.py
+++ b/steward/ansible/executor.py
@@ -13,6 +13,8 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import TYPE_CHECKING
 
+from steward.core.crypto import is_encrypted as _crypto_is_encrypted
+
 if TYPE_CHECKING:
     from quart import Quart
 
@@ -133,8 +135,12 @@ def build_credentials(creds: dict | None, tmpdir: str) -> tuple[list[str], list[
     files: list[tuple[str, str]] = []
     creds = creds or {}
 
+    from steward.core.crypto import is_encrypted
     key = creds.get("ssh_private_key")
-    if key:
+    # A still-encrypted value means decryption failed (app secret key changed) —
+    # writing the ciphertext as a key file just yields a cryptic libcrypto error,
+    # so skip it; start_run surfaces a clear message instead.
+    if key and not is_encrypted(key):
         path = os.path.join(tmpdir, "id_key")
         files.append((path, key if key.endswith("\n") else key + "\n"))
         args += ["--private-key", path]
@@ -391,6 +397,11 @@ async def start_run(
             effective_creds = dict(creds)
             if conn.get("password"):
                 effective_creds.pop("ssh_private_key", None)
+            elif _crypto_is_encrypted(effective_creds.get("ssh_private_key") or ""):
+                _broadcast(run_id,
+                           "[run error] The managed SSH key could not be decrypted "
+                           "(the app secret key changed). Regenerate it in "
+                           "Settings → Ansible and re-provision the host(s).")
 
             cred_args, cred_files = build_credentials(effective_creds, tmpdir)
             boot_args, boot_files = build_bootstrap(conn, tmpdir)