diff --git a/src/frontend/apps/impress/src/pages/docs/[id]/index.tsx b/src/frontend/apps/impress/src/pages/docs/[id]/index.tsx
index b7c8af3af..020145d5a 100644
--- a/src/frontend/apps/impress/src/pages/docs/[id]/index.tsx
+++ b/src/frontend/apps/impress/src/pages/docs/[id]/index.tsx
@@ -296,10 +296,6 @@ const DocPage = ({ id }: DocProps) => {
     return <Loading />;
   }
 
-  if (doc.is_encrypted && decryptionFailure) {
-    return <DecryptionFailurePanel failure={decryptionFailure} />;
-  }
-
   if (doc.is_encrypted && vaultClientError) {
     return (
       <EncryptionEmptyState
@@ -375,6 +371,12 @@ const DocPage = ({ id }: DocProps) => {
     );
   }
 
+  // After the access checks: with no keys on this device, the editor's attempt fails
+  // too (MISSING_KEYS), and setting encryption up is the answer, not a retry.
+  if (doc.is_encrypted && decryptionFailure) {
+    return <DecryptionFailurePanel failure={decryptionFailure} />;
+  }
+
   if (encryptionTransition) {
     return (
       <EncryptionEmptyState