diff --git a/letta/orm/agent.py b/letta/orm/agent.py
index 3b30ad8a..747cc146 100644
--- a/letta/orm/agent.py
+++ b/letta/orm/agent.py
@@ -14,6 +14,8 @@ from letta.orm.mixins import OrganizationMixin, ProjectMixin, TemplateEntityMixi
 from letta.orm.organization import Organization
 from letta.orm.sqlalchemy_base import SqlalchemyBase
 from letta.schemas.agent import AgentState as PydanticAgentState
+
+ENCRYPTED_PLACEHOLDER = "<encrypted>"
 from letta.schemas.embedding_config import EmbeddingConfig
 from letta.schemas.enums import AgentType
 from letta.schemas.environment_variables import AgentEnvironmentVariable as PydanticAgentEnvVar
@@ -458,7 +460,7 @@ class Agent(SqlalchemyBase, OrganizationMixin, ProjectMixin, TemplateEntityMixin
                     "description": e.description,
                     "organization_id": e.organization_id,
                     "agent_id": e.agent_id,
-                    "value": "",  # Empty string, will be decrypted later
+                    "value": ENCRYPTED_PLACEHOLDER,
                     "value_enc": Secret.from_encrypted(e.value_enc) if e.value_enc else None,
                 }
                 env_vars_pydantic.append(AgentEnvironmentVariable.model_validate(data))
diff --git a/letta/utils.py b/letta/utils.py
index d34546d5..d6dad4b9 100644
--- a/letta/utils.py
+++ b/letta/utils.py
@@ -1491,7 +1491,9 @@ async def decrypt_agent_secrets(agents: list) -> list:
     """
 
     async def decrypt_env_var(env_var):
-        if env_var.value_enc and (env_var.value is None or env_var.value == ""):
+        from letta.orm.agent import ENCRYPTED_PLACEHOLDER
+
+        if env_var.value_enc and (env_var.value is None or env_var.value == "" or env_var.value == ENCRYPTED_PLACEHOLDER):
             env_var.value = await env_var.value_enc.get_plaintext_async()
 
     # Collect all env vars that need decryption