diff --git a/src/Foundation.hs b/src/Foundation.hs
index 4960f292b..4289cdaad 100644
--- a/src/Foundation.hs
+++ b/src/Foundation.hs
@@ -678,10 +678,10 @@ instance Yesod UniWorX where
         encrypted plaintextJson plaintext = do
           canDecrypt <- (== Authorized) <$> evalAccess AdminErrMsgR True
           shouldEncrypt <- getsYesod $ appEncryptErrors . appSettings
-          errKey <- getsYesod appErrorMsgKey
           if
             | shouldEncrypt
             , not canDecrypt -> do
+                errKey <- getsYesod appErrorMsgKey
                 nonce <- liftIO SecretBox.newNonce
                 let ciphertext = SecretBox.secretbox errKey nonce . Lazy.ByteString.toStrict $ encode plaintextJson
                     encoded = decodeUtf8 . Base64.encode $ Saltine.encode nonce <> ciphertext
diff --git a/test/CronSpec.hs b/test/CronSpec.hs
index ee9abe812..79265811c 100644
--- a/test/CronSpec.hs
+++ b/test/CronSpec.hs
@@ -21,7 +21,7 @@ sampleCron :: Natural -> Cron -> [UTCTime]
 sampleCron n = go n baseTime Nothing
   where
     go 0 _ _ _ = []
-    go (pred -> n') t mPrev cron = case nextCronMatch utcTZ mPrev t cron of
+    go (pred -> n') t mPrev cron = case nextCronMatch utcTZ mPrev 0 t cron of
       MatchAsap -> t : go n' t (Just t) cron
       MatchAt t' -> t' : go n' t' (Just t') cron
       MatchNone -> []