diff --git a/app.py b/app.py
index 4fb4d42..711a95b 100644
--- a/app.py
+++ b/app.py
@@ -211,6 +211,20 @@ def decrypt_value(ciphertext):
         return ''
 
 
+def decrypt_value_legacy(ciphertext):
+    """Decrypt or return plaintext. Tolerates unencrypted legacy values."""
+    if not ciphertext:
+        return ''
+    plaintext = decrypt_value(ciphertext)
+    if plaintext:
+        return plaintext
+    # If decryption failed, the value might already be plaintext.
+    # A Fernet token is base64 and ends with '='; a plain API key does not.
+    if not ciphertext.endswith('='):
+        return ciphertext
+    return ''
+
+
 def settings_file_path():
     """Return the path to the persistent runtime settings JSON file."""
     return Path(current_app.config['DATABASE']).parent / current_app.config['SETTINGS_FILE']
@@ -275,7 +289,7 @@ def get_hermes_api_key():
     regenerated from /admin/settings without redeploying.
     """
     cfg = load_booth_settings()
-    return decrypt_value(cfg.get('hermes_api_key', '')) or current_app.config.get('HERMES_API_KEY', '')
+    return decrypt_value_legacy(cfg.get('hermes_api_key', '')) or current_app.config.get('HERMES_API_KEY', '')
 
 
 def set_hermes_api_key(key):