diff --git a/src/dird/dird_conf.c b/src/dird/dird_conf.c
index 1a41d8ff5ed..30de4f89707 100644
--- a/src/dird/dird_conf.c
+++ b/src/dird/dird_conf.c
@@ -1728,8 +1728,8 @@ void free_resource(RES *sres, int type)
       if (res->res_dir.verid) {
          free(res->res_dir.verid);
       }
-      if (res->res_dir.keyencrkey) {
-         free(res->res_dir.keyencrkey);
+      if (res->res_dir.keyencrkey.value) {
+         free(res->res_dir.keyencrkey.value);
       }
       if (res->res_dir.audit_events) {
          delete res->res_dir.audit_events;
diff --git a/src/dird/dird_conf.h b/src/dird/dird_conf.h
index 981090a65dc..8122739d2a2 100644
--- a/src/dird/dird_conf.h
+++ b/src/dird/dird_conf.h
@@ -138,7 +138,7 @@ class DIRRES: public BRSRES {
    uint32_t jcr_watchdog_time;        /* Absolute time after which a Job gets terminated regardless of its progress */
    uint32_t stats_collect_interval;   /* Statistics collect interval in seconds */
    char *verid;                       /* Custom Id to print in version command */
-   char *keyencrkey;                  /* Key Encryption Key */
+   s_password keyencrkey;             /* Key Encryption Key */
 };
 
 /*
diff --git a/src/dird/ua_label.c b/src/dird/ua_label.c
index 3ac110a98f5..58a7bef553a 100644
--- a/src/dird/ua_label.c
+++ b/src/dird/ua_label.c
@@ -688,13 +688,13 @@ static bool generate_new_encryption_key(UAContext *ua, MEDIA_DBR *mr)
    /*
     * See if we need to wrap the passphrase.
     */
-   if (me->keyencrkey) {
+   if (me->keyencrkey.value) {
       char *wrapped_passphrase;
 
       length = DEFAULT_PASSPHRASE_LENGTH + 8;
       wrapped_passphrase = (char *)malloc(length);
       memset(wrapped_passphrase, 0, length);
-      aes_wrap((unsigned char *)me->keyencrkey,
+      aes_wrap((unsigned char *)me->keyencrkey.value,
                DEFAULT_PASSPHRASE_LENGTH / 8,
                (unsigned char *)passphrase,
                (unsigned char *)wrapped_passphrase);