diff --git a/packages/nocodb/src/version-upgrader/upgraders/0225002_ncDatasourceDecrypt.ts b/packages/nocodb/src/version-upgrader/upgraders/0225002_ncDatasourceDecrypt.ts
index b5789a233f..4034f6b9a5 100644
--- a/packages/nocodb/src/version-upgrader/upgraders/0225002_ncDatasourceDecrypt.ts
+++ b/packages/nocodb/src/version-upgrader/upgraders/0225002_ncDatasourceDecrypt.ts
@@ -12,9 +12,19 @@ const logger = {
 };
 
 const decryptConfig = async (encryptedConfig: string, secret: string) => {
-  return CryptoJS.AES.decrypt(encryptedConfig, secret).toString(
+  if (!encryptedConfig) return encryptedConfig;
+
+  const decryptedVal = CryptoJS.AES.decrypt(encryptedConfig, secret).toString(
     CryptoJS.enc.Utf8,
   );
+
+  // validate by parsing JSON
+  try {
+    JSON.parse(decryptedVal);
+  } catch {
+    throw new Error('Config decryption failed');
+  }
+  return decryptedVal;
 };
 
 // decrypt datasource details in source table and integration table
diff --git a/scripts/updateCliVersion.js b/scripts/updateCliVersion.js
index e6affb39a9..c456504f14 100644
--- a/scripts/updateCliVersion.js
+++ b/scripts/updateCliVersion.js
@@ -1,7 +1,7 @@
 const fs = require('fs')
 const path = require('path')
 
-const packageJsonPath =path.join(__dirname, '..', 'packages', 'nc-secret-cli', 'package.json')
+const packageJsonPath = path.join(__dirname, '..', 'packages', 'nc-secret-cli', 'package.json')
 
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'))