diff --git a/src/plugins/stored/scsicrypto-sd.c b/src/plugins/stored/scsicrypto-sd.c
index 9b3fbfaa3ff..c6495c42c08 100644
--- a/src/plugins/stored/scsicrypto-sd.c
+++ b/src/plugins/stored/scsicrypto-sd.c
@@ -379,18 +379,18 @@ static bRC do_set_scsi_encryption_key(void *value)
     */
    if (dcr->jcr && dcr->jcr->director) {
       director = dcr->jcr->director;
-      if (director->keyencrkey) {
+      if (director->keyencrkey.value) {
          char WrappedVolEncrKey[MAX_NAME_LENGTH];
 
          memcpy(WrappedVolEncrKey, VolEncrKey, MAX_NAME_LENGTH);
          memset(VolEncrKey, 0, MAX_NAME_LENGTH);
 
-         if (aes_unwrap((unsigned char *)director->keyencrkey,
+         if (aes_unwrap((unsigned char *)director->keyencrkey.value,
                         DEFAULT_PASSPHRASE_LENGTH / 8,
                         (unsigned char *)WrappedVolEncrKey,
                         (unsigned char *)VolEncrKey) != 0) {
             Dmsg1(dbglvl,
-                  "scsicrypto-sd: Failed to unwrap encryption key using %s\n", director->keyencrkey);
+                  "scsicrypto-sd: Failed to unwrap encryption key using %s\n", director->keyencrkey.value);
             Emsg0(M_ERROR, 0,
                   _("scsicrypto-sd: Failed to unwrap encryption key, probably wrong KeyEncryptionKey in config\n"));
             return bRC_Error;
diff --git a/src/stored/stored_conf.c b/src/stored/stored_conf.c
index 1cd3f5afc7b..c9840764f37 100644
--- a/src/stored/stored_conf.c
+++ b/src/stored/stored_conf.c
@@ -638,8 +638,8 @@ void free_resource(RES *sres, int type)
       if (res->res_dir.tls_allowed_cns) {
          delete res->res_dir.tls_allowed_cns;
       }
-      if (res->res_dir.keyencrkey) {
-         free(res->res_dir.keyencrkey);
+      if (res->res_dir.keyencrkey.value) {
+         free(res->res_dir.keyencrkey.value);
       }
       break;
    case R_NDMP:
diff --git a/src/stored/stored_conf.h b/src/stored/stored_conf.h
index dd6776b1ddd..2173850a910 100644
--- a/src/stored/stored_conf.h
+++ b/src/stored/stored_conf.h
@@ -63,7 +63,7 @@ class DIRRES {
    char *tls_dhfile;                  /* TLS Diffie-Hellman Parameters */
    alist *tls_allowed_cns;            /* TLS Allowed Clients */
    uint64_t max_bandwidth_per_job;    /* Bandwidth limitation (per director) */
-   char *keyencrkey;                  /* Key Encryption Key */
+   s_password keyencrkey;             /* Key Encryption Key */
 
    TLS_CONTEXT *tls_ctx;              /* Shared TLS Context */
 };