diff --git a/spec/unit/crypto/backup.spec.js b/spec/unit/crypto/backup.spec.js
index a4956647f..d13b5b608 100644
--- a/spec/unit/crypto/backup.spec.js
+++ b/spec/unit/crypto/backup.spec.js
@@ -215,14 +215,9 @@ describe("MegolmBackup", function() {
                     }
                 });
             };
-            const decryption = new global.Olm.PkDecryption();
-            decryption.unpickle(
-                "secret_key",
-                "qx37WTQrjZLz5tId/uBX9B3/okqAbV1ofl9UnHKno1eipByCpXleAAlAZoJgYnCDOQZD"
-                + "QWzo3luTSfkF9pU1mOILCbbouubs6TVeDyPfgGD9i86J8irHjA"
-            );
             return client.restoreKeyBackups(
-                decryption,
+                "qx37WTQrjZLz5tId/uBX9B3/okqAbV1ofl9UnHKno1eipByCpXleAAlAZoJgYnCDOQZD"
+                + "QWzo3luTSfkF9pU1mOILCbbouubs6TVeDyPfgGD9i86J8irHjA",
                 ROOM_ID,
                 'o+21hSjP+mgEmcfdslPsQdvzWnkdt0Wyo00Kp++R8Kc'
             ).then(() => {
diff --git a/src/client.js b/src/client.js
index e9f651d49..56d546eb1 100644
--- a/src/client.js
+++ b/src/client.js
@@ -765,7 +765,7 @@ MatrixClient.prototype.createKeyBackupVersion = function(callback) {
         this._crypto.backupKey = encryption;
         // FIXME: pickle isn't the right thing to use, but we don't have
         // anything else yet
-        const recovery_key = decryption.pickle("");
+        const recovery_key = decryption.pickle("secret_key");
         callback(null, recovery_key);
         return recovery_key;
     });
@@ -818,6 +818,10 @@ MatrixClient.prototype.restoreKeyBackups = function(decryptionKey, roomId, sessi
         throw new Error("End-to-end encryption disabled");
     }
 
+    // FIXME: see the FIXME in createKeyBackupVersion
+    const decryption = new global.Olm.PkDecryption();
+    decryption.unpickle("secret_key", decryptionKey);
+
     const path = this._makeKeyBackupPath(roomId, sessionId, version);
     return this._http.authedRequest(
         undefined, "GET", path.path, path.queryData,
@@ -826,7 +830,7 @@ MatrixClient.prototype.restoreKeyBackups = function(decryptionKey, roomId, sessi
         // FIXME: for each room, session, if response has multiple
         // decrypt response.data.session_data
         const session_data = res.session_data;
-        const key = JSON.parse(decryptionKey.decrypt(
+        const key = JSON.parse(decryption.decrypt(
             session_data.ephemeral,
             session_data.mac,
             session_data.ciphertext