diff --git a/claude-mode.ps1 b/claude-mode.ps1
index f27bd0b..9a24636 100644
--- a/claude-mode.ps1
+++ b/claude-mode.ps1
@@ -379,7 +379,10 @@ function Set-VaultKey {
     Initialize-Root
     if ($Key) {
         Write-Warn2 'the key was given on the command line, so it is in this shell history - the hidden prompt leaves no trace'
-        $plain = $Key
+        $plain  = $Key
+        # The vault is written from a SecureString (DPAPI), so the inline form
+        # has to produce one too.
+        $secure = ConvertTo-SecureString -String $Key -AsPlainText -Force
     } else {
         Write-Host "Paste the API key for ref '$Ref' (input hidden):"
         $secure = Read-Host -AsSecureString